CWE-147: Improper Neutralization of Input Terminators
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component.
5 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2024-52505 — matrix-appservice-irc allows IRC Command injection in provisioning API
- CVE-2025-7962 — In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate
- CVE-2024-52006 — Newline confusion in credential helpers can lead to credential exfiltration in git
Recently published
- CVE-2025-7962 — In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate
- CVE-2024-52006 — Newline confusion in credential helpers can lead to credential exfiltration in git
- CVE-2024-52505 — matrix-appservice-irc allows IRC Command injection in provisioning API
More specific weaknesses
- CWE-626 — Poison Null Byte