CWE-93: CRLF Injection
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
183 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2024-51501 — CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes
- CVE-2024-32986 — Arbitrary code execution due to improper sanitization of web app properties in PWAsForFirefox
- CVE-2025-40671 — SQL injection vulnerability in AES Multimedia's Gestnet
- CVE-2026-29046 — TinyWeb: HTTP Header Control Character Injection into CGI Environment
- CVE-2025-8715 — PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server
- CVE-2026-23953 — Incus container environment configuration newline injection
- CVE-2025-53094 — ESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cpp
- CVE-2024-48868 — QTS, QuTS hero
- CVE-2026-77550 — A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability fo
- CVE-2026-45372 — cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection
- CVE-2026-84372 — Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
- CVE-2025-59151 — Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection
- CVE-2024-20337 — A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacke
- CVE-2026-72590 — alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter
- CVE-2026-11362 — DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags
- CVE-2026-75925 — IXON VPN Client CRLF Injection
- CVE-2026-82854 — Nodemailer before 8.0.3 SMTP Command Injection via envelope.size
- CVE-2026-34458 — Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly
- CVE-2026-21428 — cpp-httplib has CRLF injection in http headers
- CVE-2026-50638 — Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections
Recently published
- CVE-2026-48019 — CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
- CVE-2026-75925 — IXON VPN Client CRLF Injection
- CVE-2026-84962 — Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
- CVE-2026-84379 — HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
- CVE-2026-84372 — Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
- CVE-2026-82854 — Nodemailer before 8.0.3 SMTP Command Injection via envelope.size
- CVE-2026-82853 — Nodemailer before 8.0.5 SMTP Command Injection via CRLF
- CVE-2026-82661 — Nodemailer CRLF Injection via List-* Header Comments
- CVE-2026-33606 — Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator
- CVE-2026-77341 — cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing
- CVE-2026-54511 — @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys
- CVE-2026-77550 — A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability fo
- CVE-2026-77549 — A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CR
- CVE-2026-77634 — CakePHP: SmtpTransport vulnerable to CRLF header injection
- CVE-2026-75922 — Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line
- CVE-2026-74866 — @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
- CVE-2026-75484 — HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
- CVE-2026-53533 — aiosmtplib: SMTP command injection via CR/LF in sender/recipient address
- CVE-2026-71573 — Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
- CVE-2026-71572 — Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2
More specific weaknesses
- CWE-113 — HTTP Request/Response Splitting