CWE-93
CVEs classified under CWE-93, newest first.
137 CVEsRSS
CVE-2026-67289Critical· 9.8⚖ disputedFreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client…
CVE-2026-49756MediumReq vulnerable to multipart form-data header injection via unescaped name/filename/content_type
Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type
CVE-2026-16313High· 7.6A flaw was found in sg3_utils
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-suppl…
CVE-2026-59919Medium· 5.5Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
CVE-2026-59920Medium· 6.5Netty: STOMP CONNECT Frame Header Injection in Netty
Netty: STOMP CONNECT Frame Header Injection in Netty
CVE-2026-59921Medium· 5.7io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder (CVE-2026-59921)
A flaw was found in Netty's HttpPostRequestEncoder, a widely used Java networking library component responsible for constructing multipart HTTP request bodies. The issue arises because user-supplied filenames and field names are directly e…
CVE-2026-48861Lowmint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`
mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`
CVE-2026-47069LowHackney has CRLF / header injection via unvalidated `domain` and `path` options
Hackney has CRLF / header injection via unvalidated `domain` and `path` options
CVE-2026-47075MediumHackney has CR/LF injection in query parameter
Hackney has CR/LF injection in query parameter
CVE-2026-47072MediumHackney has CRLF / header injection in WebSocket upgrade request
Hackney has CRLF / header injection in WebSocket upgrade request
CVE-2026-57281High· 7.5Jenkins Script Security Plugin has a script security bypass vulnerability
Jenkins Script Security Plugin has a script security bypass vulnerability
CVE-2026-47242High· 7.3net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
A flaw was found in Net::IMAP, a Ruby library that implements Internet Message Access Protocol (IMAP) client functionality. This vulnerability arises from improper input validation when handling ID field values and arguments to the `enable…
GHSA-74p7-6h78-gw8pHighskillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery
skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery
CVE-2026-55766Medium· 4.8guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
CVE-2026-55603High· 7.5http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
CVE-2026-50188MediumKirby: Request header injection in `Http\Remote`
Kirby: Request header injection in `Http\Remote`
GHSA-5vg9-5847-vvmqHigh· 8.9Laravel Framework: CRLF injection in default email rule
Laravel Framework: CRLF injection in default email rule
CVE-2026-9679Medium· 5.9undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (CVE-2026-9679)
A flaw was found in undici. The cookie parser in the `parseSetCookie` function incorrectly decodes cookie values, which is contrary to standard specifications. This vulnerability allows an attacker-controlled upstream to inject arbitrary H…
GHSA-7cx2-g3h9-382pHigh· 8.1Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server
Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server
GHSA-268h-hp4c-crq3Medium· 5.4Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
CVE-2026-50269Lowaiohttp: CRLF injection in multipart headers
aiohttp: CRLF injection in multipart headers
CVE-2026-50629Medium· 5.3The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries,…
CVE-2026-28970MediumSwiftNIO: CRLF Injection in outbound HTTP request URI via NIOHTTPRequestHeadersValidator
SwiftNIO: CRLF Injection in outbound HTTP request URI via NIOHTTPRequestHeadersValidator
CVE-2026-12143High· 7.5PoCform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…
CVE-2026-49214Medium· 5.3guzzlehttp/psr7 has CRLF Injection via URI Host Component
guzzlehttp/psr7 has CRLF Injection via URI Host Component
CVE-2026-47240MediumNet::IMAP: Command Injection via non-synchronizing literal in "raw" argument
Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument
CVE-2026-48596Low· 3.7PoCImproper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2. Tesla.Multipart.add_content_typ…
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2. Tesla.Multipart.add_content_typ…
CVE-2026-42578High· 7.5PoC⚖ disputedNetty is an asynchronous, event-driven network application framework
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() …
CVE-2026-43969Low· 3.2Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a clien…
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a clien…
CVE-2026-42258Medium· 5.3Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol a…