CWE-113
AllowedImproper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Abstraction: Variant · Status: Incomplete
The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
194 vulnerabilities reference this CWE, most recent first.
GHSA-JXM3-H8QW-WGCX
Vulnerability from github – Published: 2026-09-02 15:34 – Updated: 2026-09-02 15:34The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers.
{
"affected": [],
"aliases": [
"CVE-2026-2811"
],
"database_specific": {
"cwe_ids": [
"CWE-113"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-02T15:17:38Z",
"severity": "MODERATE"
},
"details": "The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers.",
"id": "GHSA-jxm3-h8qw-wgcx",
"modified": "2026-09-02T15:34:49Z",
"published": "2026-09-02T15:34:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2811"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/48250628-9b81-4bef-b623-356ceca01215"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M5H8-M38M-3PW4
Vulnerability from github – Published: 2022-05-17 01:17 – Updated: 2025-04-20 03:34Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing.
{
"affected": [],
"aliases": [
"CVE-2016-8024"
],
"database_specific": {
"cwe_ids": [
"CWE-113"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-14T22:59:00Z",
"severity": "HIGH"
},
"details": "Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing.",
"id": "GHSA-m5h8-m38m-3pw4",
"modified": "2025-04-20T03:34:05Z",
"published": "2022-05-17T01:17:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8024"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10181"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/40911"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94823"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1037433"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M6QW-4CW2-HM4M
Vulnerability from github – Published: 2026-06-15 20:07 – Updated: 2026-06-15 20:07Summary
Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.
Impact
In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request.
Workaround
Sanitise such user input.
Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.13.5"
},
"package": {
"ecosystem": "PyPI",
"name": "aiohttp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-50269"
],
"database_specific": {
"cwe_ids": [
"CWE-113",
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-15T20:07:26Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Summary\n\nAttacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.\n\n### Impact\n\nIn the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.\n\n### Workaround\n\nSanitise such user input.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8",
"id": "GHSA-m6qw-4cw2-hm4m",
"modified": "2026-06-15T20:07:26Z",
"published": "2026-06-15T20:07:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m"
},
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8"
},
{
"type": "PACKAGE",
"url": "https://github.com/aio-libs/aiohttp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "aiohttp: CRLF injection in multipart headers"
}
GHSA-M9G3-3G99-MHPX
Vulnerability from github – Published: 2026-05-08 20:49 – Updated: 2026-06-08 23:29Summary
eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\n, \r, or \r\n) and thereby forge additional SSE fields or entire messages on the stream. This is similar in spirit to GHSA-4hxc-9384-m385 (h3), but the vulnerable fields are event/id rather than data/comment. These are less likely to be user-controllable, but should still be sanitized.
Details
In src/encode.ts, encodeMessage interpolates event and id into the output without inspecting them for line terminators:
if (message.event) {
output += `event: ${message.event}\n`
}
// ...
if (typeof message.id === 'string' || typeof message.id === 'number') {
output += `id: ${message.id}\n`
}
The SSE specification treats \r, \n, and \r\n as line terminators. A \n (or \r) embedded in either field is rendered as the end of that field, allowing the rest of the input to be interpreted by the client as new SSE fields.
By contrast, data and comment already normalize all three line-terminator forms via NEWLINES_RE = /(\r\n|\r|\n)/g, so they are not affected.
Proof of concept
import {encode} from 'eventsource-encoder'
// Attacker-controlled value flows into `event`
const userSuppliedTopic = 'message\nevent: admin\ndata: {"role":"admin"}'
console.log(encode({event: userSuppliedTopic, data: 'hello'}))
Output:
event: message
event: admin
data: {"role":"admin"}
data: hello
The browser sees two events: a forged admin event with attacker-chosen payload, followed by the legitimate message event. The same primitive works through id for any string id value.
Impact
If untrusted input is passed into the event or id field of a message, an attacker can:
- Spoof events of arbitrary type (rerouting payloads to handlers the attacker chooses)
- Inject additional SSE fields (
data:,id:,retry:) into the stream - Split a single
encode()call into multiple distinct browser events - Override the client's
Last-Event-IDvia injectedid:lines
The vulnerability requires that an application places attacker-controlled data into event or id. Applications that only put trusted, statically-defined values into these fields are not affected.
Patches
Fixed in eventsource-encoder@1.0.2. The event and string id fields are now validated; any value containing \r or \n causes the encoder to throw a TypeError rather than emit a malformed stream.
Workarounds
If users cannot upgrade, validate or strip line terminators from any untrusted value before passing it to encode / encodeMessage:
function safeSingleLine(value) {
if (/[\r\n]/.test(value)) throw new Error('SSE field must be single-line')
return value
}
encode({event: safeSingleLine(topic), id: safeSingleLine(id), data})
Resources
- Related advisory (different package, same class): https://github.com/advisories/GHSA-4hxc-9384-m385
- SSE spec, line terminators: https://html.spec.whatwg.org/multipage/server-sent-events.html#parsing-an-event-stream
Credit
Discovered while reviewing in light of GHSA-4hxc-9384-m385.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.1"
},
"package": {
"ecosystem": "npm",
"name": "eventsource-encoder"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44214"
],
"database_specific": {
"cwe_ids": [
"CWE-113",
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-08T20:49:40Z",
"nvd_published_at": "2026-05-26T20:16:19Z",
"severity": "MODERATE"
},
"details": "### Summary\n\n`eventsource-encoder` does not sanitize the `event` or `id` fields of an `EventSourceMessage` before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (`\\n`, `\\r`, or `\\r\\n`) and thereby forge additional SSE fields or entire messages on the stream. This is similar in spirit to [GHSA-4hxc-9384-m385](https://github.com/advisories/GHSA-4hxc-9384-m385) (h3), but the vulnerable fields are `event`/`id` rather than `data`/`comment`. These are less likely to be user-controllable, but should still be sanitized.\n\n### Details\n\nIn `src/encode.ts`, `encodeMessage` interpolates `event` and `id` into the output without inspecting them for line terminators:\n\n```ts\nif (message.event) {\n output += `event: ${message.event}\\n`\n}\n// ...\nif (typeof message.id === \u0027string\u0027 || typeof message.id === \u0027number\u0027) {\n output += `id: ${message.id}\\n`\n}\n```\n\nThe SSE specification treats `\\r`, `\\n`, and `\\r\\n` as line terminators. A `\\n` (or `\\r`) embedded in either field is rendered as the end of that field, allowing the rest of the input to be interpreted by the client as new SSE fields.\n\nBy contrast, `data` and `comment` already normalize all three line-terminator forms via `NEWLINES_RE = /(\\r\\n|\\r|\\n)/g`, so they are not affected.\n\n### Proof of concept\n\n```js\nimport {encode} from \u0027eventsource-encoder\u0027\n\n// Attacker-controlled value flows into `event`\nconst userSuppliedTopic = \u0027message\\nevent: admin\\ndata: {\"role\":\"admin\"}\u0027\n\nconsole.log(encode({event: userSuppliedTopic, data: \u0027hello\u0027}))\n```\n\nOutput:\n\n```\nevent: message\nevent: admin\ndata: {\"role\":\"admin\"}\ndata: hello\n\n```\n\nThe browser sees two events: a forged `admin` event with attacker-chosen payload, followed by the legitimate `message` event. The same primitive works through `id` for any string id value.\n\n### Impact\n\nIf untrusted input is passed into the `event` or `id` field of a message, an attacker can:\n\n- Spoof events of arbitrary type (rerouting payloads to handlers the attacker chooses)\n- Inject additional SSE fields (`data:`, `id:`, `retry:`) into the stream\n- Split a single `encode()` call into multiple distinct browser events\n- Override the client\u0027s `Last-Event-ID` via injected `id:` lines\n\nThe vulnerability requires that an application places attacker-controlled data into `event` or `id`. Applications that only put trusted, statically-defined values into these fields are not affected.\n\n### Patches\n\nFixed in `eventsource-encoder@1.0.2`. The `event` and string `id` fields are now validated; any value containing `\\r` or `\\n` causes the encoder to throw a `TypeError` rather than emit a malformed stream.\n\n### Workarounds\n\nIf users cannot upgrade, validate or strip line terminators from any untrusted value before passing it to `encode` / `encodeMessage`:\n\n```js\nfunction safeSingleLine(value) {\n if (/[\\r\\n]/.test(value)) throw new Error(\u0027SSE field must be single-line\u0027)\n return value\n}\n\nencode({event: safeSingleLine(topic), id: safeSingleLine(id), data})\n```\n\n### Resources\n\n- Related advisory (different package, same class): https://github.com/advisories/GHSA-4hxc-9384-m385\n- SSE spec, line terminators: https://html.spec.whatwg.org/multipage/server-sent-events.html#parsing-an-event-stream\n\n### Credit\n\nDiscovered while reviewing in light of GHSA-4hxc-9384-m385.",
"id": "GHSA-m9g3-3g99-mhpx",
"modified": "2026-06-08T23:29:22Z",
"published": "2026-05-08T20:49:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rexxars/eventsource-encoder/security/advisories/GHSA-m9g3-3g99-mhpx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44214"
},
{
"type": "PACKAGE",
"url": "https://github.com/rexxars/eventsource-encoder"
},
{
"type": "WEB",
"url": "https://html.spec.whatwg.org/multipage/server-sent-events.html#parsing-an-event-stream"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields"
}
GHSA-MFRC-633M-GCWG
Vulnerability from github – Published: 2022-05-14 01:35 – Updated: 2022-05-14 01:35CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
{
"affected": [],
"aliases": [
"CVE-2016-5699"
],
"database_specific": {
"cwe_ids": [
"CWE-113"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-09-02T14:59:00Z",
"severity": "MODERATE"
},
"details": "CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.",
"id": "GHSA-mfrc-633m-gcwg",
"modified": "2022-05-14T01:35:21Z",
"published": "2022-05-14T01:35:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5699"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1626"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1627"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1628"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1629"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1630"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2016-5699"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1303699"
},
{
"type": "WEB",
"url": "https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4"
},
{
"type": "WEB",
"url": "https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS"
},
{
"type": "WEB",
"url": "https://hg.python.org/cpython/rev/1c45047c5102"
},
{
"type": "WEB",
"url": "https://hg.python.org/cpython/rev/bf3e1c9b80e9"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html"
},
{
"type": "WEB",
"url": "http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1626.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1627.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1628.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1629.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1630.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/06/14/7"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/06/15/12"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/06/16/2"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/91226"
},
{
"type": "WEB",
"url": "http://www.splunk.com/view/SP-CAAAPSV"
},
{
"type": "WEB",
"url": "http://www.splunk.com/view/SP-CAAAPUE"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MQH5-C2WX-V3PQ
Vulnerability from github – Published: 2025-01-21 18:31 – Updated: 2025-01-21 18:31Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.
{
"affected": [],
"aliases": [
"CVE-2024-45687"
],
"database_specific": {
"cwe_ids": [
"CWE-113"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-21T17:15:14Z",
"severity": "LOW"
},
"details": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.",
"id": "GHSA-mqh5-c2wx-v3pq",
"modified": "2025-01-21T18:31:07Z",
"published": "2025-01-21T18:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45687"
},
{
"type": "WEB",
"url": "https://docs.payara.fish/community/docs/6.2025.1/Release%20Notes/Release%20Notes%206.2025.1.html"
},
{
"type": "WEB",
"url": "https://docs.payara.fish/enterprise/docs/5.71.0/Release%20Notes/Release%20Notes%205.71.0.html"
},
{
"type": "WEB",
"url": "https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.22.0.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MWCJ-9FQH-RC64
Vulnerability from github – Published: 2022-05-14 02:03 – Updated: 2022-05-14 02:03Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943.
{
"affected": [],
"aliases": [
"CVE-2018-16979"
],
"database_specific": {
"cwe_ids": [
"CWE-113"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-12T23:29:00Z",
"severity": "MODERATE"
},
"details": "Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943.",
"id": "GHSA-mwcj-9fqh-rc64",
"modified": "2022-05-14T02:03:03Z",
"published": "2022-05-14T02:03:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16979"
},
{
"type": "WEB",
"url": "https://github.com/howchen/howchen/issues/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MWH4-6H8G-PG8W
Vulnerability from github – Published: 2026-04-01 21:48 – Updated: 2026-04-01 21:48Summary
An attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits.
Impact
In the unlikely situation that an application allows untrusted data to be used in the response's reason parameter, then an attacker could manipulate the response to send something different from what the developer intended.
Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.13.3"
},
"package": {
"ecosystem": "PyPI",
"name": "aiohttp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.13.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-34519"
],
"database_specific": {
"cwe_ids": [
"CWE-113"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-01T21:48:24Z",
"nvd_published_at": "2026-04-01T21:17:00Z",
"severity": "LOW"
},
"details": "### Summary\n\nAn attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.\n\n### Impact\n\nIn the unlikely situation that an application allows untrusted data to be used in the response\u0027s `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b",
"id": "GHSA-mwh4-6h8g-pg8w",
"modified": "2026-04-01T21:48:24Z",
"published": "2026-04-01T21:48:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34519"
},
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b"
},
{
"type": "PACKAGE",
"url": "https://github.com/aio-libs/aiohttp"
},
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "AIOHTTP has HTTP response splitting via \\r in reason phrase"
}
GHSA-PFQJ-W6R6-G86V
Vulnerability from github – Published: 2025-03-27 18:01 – Updated: 2025-03-28 16:12Impact
HTTP Response Header Injection in Pitchfork Versions < 0.11.0 when used in conjunction with Rack 3
Patches
The issue was fixed in Pitchfork release 0.11.0
Workarounds
There are no known work arounds. Users must upgrade.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "pitchfork"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-30221"
],
"database_specific": {
"cwe_ids": [
"CWE-113"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-27T18:01:18Z",
"nvd_published_at": "2025-03-27T15:16:02Z",
"severity": "MODERATE"
},
"details": "### Impact\nHTTP Response Header Injection in Pitchfork Versions \u003c 0.11.0 when used in conjunction with Rack 3\n\n### Patches\nThe issue was fixed in Pitchfork release 0.11.0\n\n### Workarounds\nThere are no known work arounds. Users must upgrade.",
"id": "GHSA-pfqj-w6r6-g86v",
"modified": "2025-03-28T16:12:43Z",
"published": "2025-03-27T18:01:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Shopify/pitchfork/security/advisories/GHSA-pfqj-w6r6-g86v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30221"
},
{
"type": "WEB",
"url": "https://github.com/Shopify/pitchfork/commit/17ed9b61bf9f58957065f7405b66102daf86bf55"
},
{
"type": "PACKAGE",
"url": "https://github.com/Shopify/pitchfork"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pitchfork/CVE-2025-30221.yml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Pitchfork HTTP Request/Response Splitting vulnerability"
}
GHSA-Q3G2-M552-3R9C
Vulnerability from github – Published: 2026-07-24 21:52 – Updated: 2026-07-24 21:52Summary
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting.
Impact
Two related gaps in inbound header validation, against any application using HTTP2ToHTTP1Codec (or HTTP2FramePayloadToHTTP1Codec) to front an HTTP/1.1 backend:
Regular header field values were only checked against a forbidden-name
list (connection, transfer-encoding, proxy-connection, keep-alive,
upgrade); the value itself was never inspected. An attacker-controlled
regular header field value containing CR or LF passed validation and, once
serialized as name: value CRLF by the codec, terminated the field early
and injected extra header lines into the outbound HTTP/1.1 message.
Pseudo-header values (:path in particular) were only checked against
CR, LF and NUL. A :path value containing SP serializes into the
request-target of METHOD SP request-target SP HTTP-version CRLF, so a
value like /a HTTP/1.1 produces GET /a HTTP/1.1 HTTP/1.1 — a
parser-differential request line depending on whether a downstream reader
takes the first or last SP-delimited token as the version.
Neither of these is reachable on a stock pipeline: NIOHTTP1's outbound
validator (enableOutboundHeaderValidation, on by default) already rejects
these characters on write. The exposure is pipelines that skip outbound
validation, or any code that reads validated-looking HTTPRequestHead.headers
and forwards the values on trusting that HTTP/2 already checked them.
Fix
Fixed in 48bfd90 and 45bdf67.
Mitigation
Upgrade to 1.45.0
{
"affected": [
{
"package": {
"ecosystem": "SwiftURL",
"name": "swift-nio-http2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.45.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-64785"
],
"database_specific": {
"cwe_ids": [
"CWE-113",
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T21:52:10Z",
"nvd_published_at": "2026-07-23T20:17:21Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nSwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let\nCR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend\nthrough NIOHTTP2\u0027s HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling\nor response splitting.\n\n## Impact\n\nTwo related gaps in inbound header validation, against any application\nusing HTTP2ToHTTP1Codec (or HTTP2FramePayloadToHTTP1Codec) to front an\nHTTP/1.1 backend:\n\nRegular header field values were only checked against a forbidden-name\nlist (connection, transfer-encoding, proxy-connection, keep-alive,\nupgrade); the value itself was never inspected. An attacker-controlled\nregular header field value containing CR or LF passed validation and, once\nserialized as `name: value CRLF` by the codec, terminated the field early\nand injected extra header lines into the outbound HTTP/1.1 message.\n\nPseudo-header values (`:path` in particular) were only checked against\nCR, LF and NUL. A `:path` value containing SP serializes into the\nrequest-target of `METHOD SP request-target SP HTTP-version CRLF`, so a\nvalue like `/a HTTP/1.1` produces `GET /a HTTP/1.1 HTTP/1.1` \u2014 a\nparser-differential request line depending on whether a downstream reader\ntakes the first or last SP-delimited token as the version.\n\nNeither of these is reachable on a stock pipeline: NIOHTTP1\u0027s outbound\nvalidator (`enableOutboundHeaderValidation`, on by default) already rejects\nthese characters on write. The exposure is pipelines that skip outbound\nvalidation, or any code that reads validated-looking `HTTPRequestHead.headers`\nand forwards the values on trusting that HTTP/2 already checked them.\n\n## Fix\n\nFixed in 48bfd90 and 45bdf67.\n\n## Mitigation\n\nUpgrade to 1.45.0",
"id": "GHSA-q3g2-m552-3r9c",
"modified": "2026-07-24T21:52:10Z",
"published": "2026-07-24T21:52:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-q3g2-m552-3r9c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64785"
},
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio-http2/commit/45bdf670248be5f16ec0340e125dca285536f0fb"
},
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio-http2/commit/48bfd9067d7d1d15c4789440127a0cf36222ea43"
},
{
"type": "PACKAGE",
"url": "https://github.com/apple/swift-nio-http2"
},
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio-http2/releases/tag/1.45.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "swift-nio-http2: Missing CR/LF/NUL validation in header values"
}
Mitigation
Strategy: Input Validation
Construct HTTP headers very carefully, avoiding the use of non-validated input data.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. If an input does not strictly conform to specifications, reject it or transform it into something that conforms.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation MIT-30
Strategy: Output Encoding
Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or automatically inferring which encoding is being used, which can be erroneous. When the encodings are inconsistent, the downstream component might treat some character or byte sequences as special, even if they are not special in the original encoding. Attackers might then be able to exploit this discrepancy and conduct injection attacks; they even might be able to bypass protection mechanisms that assume the original encoding is also being used by the downstream component.
Mitigation MIT-20
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
CAPEC-105: HTTP Request Splitting
An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to split a single HTTP request into multiple unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server).
See CanPrecede relationships for possible consequences.
CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies
This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. There are several different forms of this attack. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the adversary to impersonate the remote user/session. The third form is when the cookie's content is modified by the adversary before it is sent back to the server. Here the adversary seeks to convince the target server to operate on this falsified information.
CAPEC-34: HTTP Response Splitting
An adversary manipulates and injects malicious content, in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., web server) or into an already spoofed HTTP response from an adversary controlled domain/site.
See CanPrecede relationships for possible consequences.
CAPEC-85: AJAX Footprinting
This attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system. While Ajax does not open up new vulnerabilities per se, it does optimize them from an attacker point of view. A common first step for an attacker is to footprint the target environment to understand what attacks will work. Since footprinting relies on enumeration, the conversational pattern of rapid, multiple requests and responses that are typical in Ajax applications enable an attacker to look for many vulnerabilities, well-known ports, network locations and so on. The knowledge gained through Ajax fingerprinting can be used to support other attacks, such as XSS.