cve.bz

CWE-93: Improper Neutralization of CRLF Sequences (CRLF Injection)

Filter

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

What the weakness is: CWE-93 at MITRE

Ask an AI about CWE-93

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-93: Improper Neutralization of CRLF Sequences and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/93.html and https://cve.bz/cve/cwe/93?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. –CVE-2026-13575

    HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Sto…

  2. 6.0CVE-2026-119560EPSS 0.3%

    OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps o…

  3. 6.1CVE-2026-119424EPSS 0.4%

    OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines i…

  4. 6.3CVE-2026-119417EPSS 0.5%

    CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incompl…

  5. 6.3CVE-2026-119415EPSS 0.4%

    CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME t…

  6. 3.7CVE-2026-115303EPSS 0.2%

    The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field int…

  7. 6.3CVE-2026-118372EPSS 0.1%

    LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting c…

  8. 6.3CVE-2026-118371EPSS 0.1%

    LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return a…

  9. 8.5CVE-2026-116237EPSS 0.4%

    A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made…

  10. 8.5CVE-2026-116235EPSS 0.6%

    A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be ini…

  11. 8.5CVE-2026-116234EPSS 0.5%

    A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attac…

  12. 8.5CVE-2026-116233EPSS 0.5%

    A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely…

  13. 8.6CVE-2026-116232EPSS 0.4%

    A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch …

  14. 8.6CVE-2026-116231EPSS 0.4%

    A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initia…

  15. 4.3CVE-2026-115785EPSS 0.7%

    An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an …

  16. 7.1CVE-2026-114720EPSS 0.8%

    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to…

  17. 2.0CVE-2026-113715EPSS 0.2%

    virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untruste…

  18. 7.1CVE-2026-113403EPSS 0.7%

    ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.

  19. 7.1CVE-2026-113386EPSS 1.0%

    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource act…

  20. 3.8CVE-2026-91831EPSS 0.2%

    The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e…

  21. 5.1CVE-2026-111228EPSS 1.8%

    Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR…

  22. 5.1CVE-2026-111227EPSS 1.8%

    Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can e…

  23. 7.5CVE-2026-111222EPSS 1.0%

    Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and new…

  24. 7.5CVE-2026-111221EPSS 0.9%

    Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit priv…

  25. 8.6CVE-2026-111220EPSS 0.7%

    pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding…

  26. 7.5CVE-2026-111219EPSS 0.9%

    Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit pri…

  27. 2.5CVE-2026-55467EPSS 0.2%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string …

  28. 6.3CVE-2026-110835EPSS 0.3%

    FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host he…

  29. 6.9CVE-2026-102471EPSS 0.3%

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) characters in user-supplied email header names and values before writing them into …

  30. 5.8CVE-2026-41504EPSS 0.4%

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neu…

  31. 6.8CVE-2026-87661EPSS 0.2%

    Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the …

  32. 6.9CVE-2026-87678EPSS 0.2%

    An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (I…

  33. 6.6CVE-2026-102145EPSS 0.3%

    An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.

  34. 6.3CVE-2026-102136EPSS 0.1%

    In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficie…

  35. 5.8CVE-2026-102938EPSS 0.1%

    virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlin…

  36. 9.4CVE-2026-82973EPSS 0.4%

    Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands …

  37. 8.5CVE-2026-100717EPSS 0.3%

    froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parse_url, and never inspects the …

  38. 7.8CVE-2026-91841EPSS 0.2%

    A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitra…

  39. 7.8CVE-2026-91840EPSS 0.2%

    A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to…

  40. 7.8CVE-2026-91839EPSS 0.2%

    A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileg…

  41. 7.2CVE-2026-61815EPSS 0.2%

    zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF (carriage-return / line-feed) header in…

  42. 5.3CVE-2026-90990EPSS 0.4%

    Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in …

  43. 8.8CVE-2026-55159EPSS 0.7%

    luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carria…

  44. 2.1CVE-2026-94216EPSS 0.4%

    A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to ht…

  45. 5.3CVE-2026-94057EPSS 0.2%

    Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.

  46. 7.5CVE-2026-93576EPSS 0.3%

    A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this f…

  47. 8.0CVE-2026-40530EPSS 0.5%

    An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbit…

  48. 3.5CVE-2026-13666EPSS 0.3%

    An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write…

  49. 6.9CVE-2026-90819EPSS 0.7%

    A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationS…

  50. 9.4CVE-2026-90937EPSS 0.5%

    froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newli…