CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Consequences

• Integrity: Modify Application Data

How to prevent it

• Implementation: Avoid using CRLF as a special sequence.
• Implementation: Appropriately filter or quote CRLF sequences in user-controlled input.

Recent advisories

• GHSA-h4x7-gw46-3wm6 — HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
• GHSA-j9f9-w8pj-32f8 — Spring Framework Server Sent Event stream corruption while rendering fragments
• EEF-CVE-2026-75484 — HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
• GHSA-8c48-q9wj-3w37 — rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
• GHSA-m8rv-5g2x-5cg5 — undici vulnerable to CRLF Injection via blob-like body 'type' property
• GHSA-gcjf-9mgh-3p7g — Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
• GHSA-cfj9-2vgr-hpxp — Jenkins Script Security Plugin has a script security bypass vulnerability
• GHSA-4v4h-m2qq-ppgw — Kirby: Request header injection in `Http\Remote`
• GHSA-p88m-4jfj-68fv — undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
• GHSA-5vg9-5847-vvmq — Laravel Framework: CRLF injection in default email rule
• GHSA-m6qw-4cw2-hm4m — aiohttp: CRLF injection in multipart headers
• GHSA-268h-hp4c-crq3 — Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
• GHSA-46q3-7gv7-qmgg — Net::IMAP: Command Injection via ID command argument
• GHSA-8p34-64r3-mwg8 — Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument
• GHSA-px9f-whj3-246m — Multipart form-data header injection in Req via unescaped name/filename/content_type

All advisories for CWE-93