Search Vulnerabilities

An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7

An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7

Kirby: Request header injection in `Http\Remote`

Hono - Vary Header Injection in CORS Middleware

guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization

AIOHTTP: CRLF injection in multipart headers

Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection

Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix

guzzlehttp/psr7 has CRLF Injection via URI Host Component

HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths

eventsource-encoder: SSE event injection via unsanitized event and id fields

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values

Microdot: HTTP response splitting in Response.set_cookie()

HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header

Apache Thrift: Node.js web_server.js multi-vulnerability

Axios: Header Injection via Prototype Pollution