CVE-2026-67289 | Critical | 9.8 | 2026-08-01 | FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress fie… |
CVE-2026-66753 | Low | 3.7 | 2026-07-28 | tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into… |
CVE-2026-66746 | Medium | 5.4 | 2026-07-28 | Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding ca… |
CVE-2026-63771 | High | 7.1 | 2026-07-20 | Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the… |
CVE-2026-54163 | Medium | 4.7 | 2026-07-17 | secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secure_headers builds the Content-Security-Policy value by stit… |
CVE-2025-62826 | Low | 3.1 | 2026-07-14 | An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 throug… |
CVE-2025-62675 | Low | 3.4 | 2026-07-14 | An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 throug… |
CVE-2026-50188 | | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, including Remote::reque… |
CVE-2025-71381 | Medium | 6.5 | 2026-06-30 | Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the… |
CVE-2026-55766 | Medium | 4.8 | 2026-06-23 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party… |
CVE-2026-50269 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload head… |
CVE-2026-50630 | Medium | 6.5 | 2026-06-12 | A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is… |
CVE-2026-44489 | Low | 3.7 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) ar… |
CVE-2026-49214 | Medium | 5.3 | 2026-06-11 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII control characters, whitespace, or DEL in… |
CVE-2026-43966 | | | 2026-06-08 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting… |
CVE-2026-48596 | | | 2026-06-02 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection… |
CVE-2026-38967 | Critical | 9.8 | 2026-06-02 | CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values. |
CVE-2026-38978 | Medium | 5.3 | 2026-06-02 | transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths. |
CVE-2026-47675 | Medium | 4.3 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domai… |
CVE-2026-9658 | High | 7.3 | 2026-05-28 | Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths.
The header injection rule was ineffectiv… |
CVE-2026-44214 | Medium | 5.8 | 2026-05-26 | eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event… |
CVE-2026-42578 | High | 7.5 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT… |
CVE-2026-7010 | Medium | 6.5 | 2026-05-11 | HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.
The unvalidated inputs are the method and… |
CVE-2026-42874 | Low | 3.7 | 2026-05-11 | Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.set_cookie() method does not sanitize its string arguments, and in particular wil… |
CVE-2026-41683 | High | 8.6 | 2026-05-08 | i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-… |
CVE-2026-43870 | High | 7.3 | 2026-05-05 | Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Head… |
CVE-2026-42035 | High | 7.4 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (li… |
CVE-2026-39971 | High | 7.2 | 2026-04-15 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTT… |
CVE-2026-40175 | Medium | 4.8 | 2026-04-10 | Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in… |
CVE-2026-34767 | Medium | 5.9 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3, a… |
CVE-2026-34715 | Medium | 5.3 | 2026-04-02 | ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and… |
CVE-2026-34520 | Critical | 9.1 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted… |
CVE-2026-34519 | Medium | 5.3 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when cre… |
CVE-2026-34514 | Medium | 5.3 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in… |
CVE-2025-55271 | Low | 3.1 | 2026-03-26 | HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split response, an attacker… |
CVE-2026-27810 | Medium | 6.4 | 2026-02-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection… |
CVE-2026-24320 | Low | 3.1 | 2026-02-10 | Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memor… |
CVE-2026-23686 | Low | 3.4 | 2026-02-10 | Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially cra… |
CVE-2026-24489 | Medium | 5.3 | 2026-01-27 | Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to version 0.1.1 that allo… |
CVE-2026-22779 | Medium | 5.3 | 2026-01-14 | BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is… |
CVE-2025-59151 | High | 8.2 | 2025-10-27 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interfa… |
CVE-2025-61689 | | | 2025-10-10 | HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values f… |
CVE-2025-40927 | High | 7.3 | 2025-08-29 | CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw
This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple tha… |
CVE-2025-42934 | Medium | 4.3 | 2025-08-12 | SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untrusted sites into t… |
CVE-2025-53094 | | | 2025-06-27 | ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF (Ca… |
CVE-2025-53007 | | | 2025-06-26 | arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response Splitting vulnerability. The `sendHeader` f… |
CVE-2025-52479 | | | 2025-06-25 | HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers (URIs). URIs.jl prior to versio… |
CVE-2025-41234 | Medium | 6.5 | 2025-06-12 | Description
In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack… |
CVE-2025-30221 | Medium | 4.3 | 2025-03-27 | Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction… |
CVE-2025-0588 | Medium | 4.9 | 2025-02-11 | In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifi… |
CVE-2025-0825 | Medium | 5.3 | 2025-02-04 | cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploi… |
CVE-2024-52875 | High | 8.8 | 2025-01-31 | An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.c… |
CVE-2024-45687 | | | 2025-01-21 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Man… |
CVE-2024-54021 | Medium | 6.5 | 2025-01-14 | An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 through 7.6.0, Forti… |
CVE-2024-42487 | Medium | 4.0 | 2024-08-15 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 branch prior to 1.16… |
CVE-2024-40324 | Medium | 5.4 | 2024-07-25 | A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fields, leading to HTTP… |
CVE-2024-20392 | Medium | 6.1 | 2024-05-15 | A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to con… |
CVE-2024-24795 | Medium | 6.3 | 2024-04-04 | HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to ca… |
CVE-2024-23644 | Medium | 6.8 | 2024-01-24 | Trillium is a composable toolkit for building internet applications with async rust. In `trillium-http` prior to 0.3.12 and `trillium-client` prior to 0.5.4, i… |
CVE-2023-48256 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted… |
CVE-2023-26147 | Medium | 5.3 | 2023-09-29 | All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers values. An attacker can… |
CVE-2023-42450 | Medium | 5.4 | 2023-09-19 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specifi… |
CVE-2023-41834 | Medium | 6.1 | 2023-09-19 | Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary… |
CVE-2023-26142 | Medium | 6.5 | 2023-09-12 | All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not prop… |
CVE-2023-26137 | High | 7.2 | 2023-07-06 | All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the ad… |
CVE-2023-34472 | Medium | 5.7 | 2023-07-05 | AMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A successful exploit of t… |
CVE-2023-0508 | Low | 3.1 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-32708 | High | 7.2 | 2023-06-01 | In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP… |
CVE-2022-42472 | Medium | 4.2 | 2023-02-16 | A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8… |
CVE-2019-25101 | Medium | 6.3 | 2023-02-04 | A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of the file turbogears/controllers.py of th… |
CVE-2022-37436 | Medium | 5.3 | 2023-01-17 | Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into… |
CVE-2022-42471 | Medium | 5.4 | 2023-01-03 | An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, Forti… |
CVE-2022-41915 | Medium | 6.5 | 2022-12-13 | Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultH… |
CVE-2022-20772 | Medium | 4.7 | 2022-11-04 | A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HT… |
CVE-2022-3215 | High | 7.5 | 2022-09-28 | NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts use… |
CVE-2022-37953 | Medium | 4.7 | 2022-08-25 | An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow an attacker to compro… |
CVE-2021-40336 | Medium | 5.0 | 2022-07-25 | A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitti… |
CVE-2021-0268 | High | 8.8 | 2021-04-22 | An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') weakness in J-web of Juniper Networks Junos OS leads to buffer overflo… |
CVE-2020-3117 | Medium | 4.7 | 2020-09-23 | A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance (WSA) and Cisco Content Security Management Appliance (SMA) could allow… |
CVE-2020-10753 | Medium | 5.4 | 2020-06-26 | A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHead… |
CVE-2020-5249 | Medium | 6.5 | 2020-03-02 | In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return… |
CVE-2020-5247 | Medium | 6.5 | 2020-02-28 | In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline charact… |
CVE-2020-5216 | Medium | 4.4 | 2020-01-23 | In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input w… |
CVE-2019-16771 | Medium | 4.8 | 2019-12-06 | Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP heade… |
CVE-2019-15259 | Medium | 6.1 | 2019-10-02 | A vulnerability in Cisco Unified Contact Center Express (UCCX) Software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting a… |
CVE-2018-18837 | Medium | 6.1 | 2019-06-18 | An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_request_v1_data in web… |
CVE-2018-16181 | Medium | 6.1 | 2019-01-09 | HTTP header injection vulnerability in i-FILTER Ver.9.50R05 and earlier may allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response s… |
CVE-2018-0689 | High | 8.8 | 2019-01-09 | HTTP header injection vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N firmware versions… |
CVE-2018-13814 | High | 8.8 | 2018-12-13 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V1… |
CVE-2018-11347 | High | 8.8 | 2018-12-04 | The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject, into the response… |
CVE-2018-7830 | High | 7.5 | 2018-11-30 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability exists in the embedded web servers in all Modicon M340, Pre… |
CVE-2018-16979 | Medium | 6.1 | 2018-09-12 | Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943. |
CVE-2018-3911 | High | 8.6 | 2018-08-23 | An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore… |
CVE-2017-7528 | Medium | 5.2 | 2018-08-22 | Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal… |
CVE-2018-1067 | Medium | 6.1 | 2018-05-21 | In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injecti… |
CVE-2017-17742 | Medium | 5.3 | 2018-04-03 | Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can in… |
CVE-2017-12308 | Medium | 6.1 | 2018-01-18 | A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to conduct an HTTP respo… |
CVE-2017-1262 | Medium | 6.1 | 2017-12-20 | IBM Security Guardium 10.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to… |
CVE-2017-12309 | Medium | 5.3 | 2017-11-16 | A vulnerability in the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a HTTP response splitting attack. The vu… |
CVE-2015-1445 | High | 7.2 | 2017-08-28 | HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30. |