EIP-2026-104211

This is a detailed technical writeup describing an HTTP Response Splitting vulnerability in cPanel and WHM versions 11.25 (up to build 42174). The vulnerability allows injection of CR and LF characters into the HTTP response header via the 'failurl' parameter, enabling attacks such as header injection, XSS, and open redirection.