Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Email header comment string is formatted into headers without stripping CRLF sequences, potentially allowing email header injection (CWE-93, CWE-113).
HTTP/2 header parsing does not validate header field values for CR, LF, or NUL characters (RFC 9113 §8.2.1). Unsanitized control characters in request headers can lead to log injection, HTTP request smuggling, or response splitting downstream.
`headerComplete` callback in HTTP parser does not check `inChunkedHeaders()` before appending header fields. This can cause HTTP/1.1 chunked trailer fields to be improperly merged into request headers, enabling HTTP header injection and proxy control bypasses (CVE-2026-73495).
Incomplete validation of HTTP/2 header or pseudo-header values allows space and control characters (0x01-0x1F, 0x20, 0x7F) through to HTTP/1.1 request lines or headers, potentially enabling HTTP request smuggling or response splitting (CWE-444, CWE-113).
Constructing a regular expression using `$` to anchor the end can result in validation bypasses. In Python's `re` module, `$` matches the absolute end of the string OR just before a newline at the end. If this regex is used to validate input which is later embedded into a different context (like HTTP headers), it could permit newline injection. Use `\Z` inst
Tornado framework's error handling accepts and processes custom HTTP reason phrases without sufficient validation against Control Characters like CRLF (leading to HTTP Header Injection) or escaping before embedding into HTML response bodies (Cross-Site Scripting). Ensure that custom reason phrases are properly validated (e.g., matching a strict ABNF token pa
Incomplete URI host validation. Validating only ASCII control characters without rejecting authority delimiters ('/', '?', '#', '@', '\\') can lead to host confusion, SSRF, or HTTP header injection.
HTTP method is merged into the request serialization list without prior validation. An attacker can pass malicious methods containing CRLF sequences to inject HTTP headers or smuggle requests. Ensure the given method string is validated to contain only allowed characters before constructing the payload.
Constructing headers or multipart parameters by directly interpolating untrusted values into a `key="value"` string format without escaping allows CRLF and double-quote injection attacks. In contexts like Content-Disposition headers, this can lead to header smuggling, parameter forgery, or multipart body manipulation. Ensure that values are checked for `\r`,
WEBrick indiscriminately appends HTTP chunked trailers to the raw request headers buffer and parses them in conjunction with the primary request headers using HTTPUtils::parse_header. This bypasses the trailer/header boundary and allows trailers to overwrite authoritative headers like Content-Length or Host, enabling HTTP Request Smuggling. The patch cleanly
Functions that set or add HTTP headers insert map entries without sanitizing the key and value to remove Carriage Return (CR, \r) and Line Feed (LF, \n) characters. Failing to do so can allow HTTP Response Header Injection (CRLF injection).
The code checks for the presence of newline characters ('\n') but fails to check for carriage returns ('\r'). In contexts where HTTP headers or status lines are constructed, failing to reject '\r' allows an attacker to inject HTTP control characters, leading to HTTP Response Splitting or CRLF injection. Ensure that both '\r' and '\n' are validated.
A function parameter is assigned to a header dictionary (e.g., content_type) without prior verification for carriage return ('\r') or newline ('\n') characters. If attacker-controlled, this can lead to header injection or multipart structure corruption.
Direct concatenation of variables into an HTTP header string without sanitization can lead to CRLF injection.
Validation missing for C0 control characters (\x00-\x1f, \x7f) inside HTTP headers. Returning string values directly without checking for '\r' or '\n' can lead to CRLF injection vulnerabilities.
This code constructs an HTTP Cookie using an untrusted HTTP parameter. If this cookie is added to an HTTP response, it will allow a HTTP response splitting vulnerability. See http://en.wikipedia.org/wiki/HTTP_response_splitting for more information.
ScalaCWE-113This code directly writes an HTTP parameter to an HTTP header, which allows for a HTTP response splitting vulnerability. See http://en.wikipedia.org/wiki/HTTP_response_splitting for more information.
ScalaCWE-113HTTP Response Splitting is a vulnerability where Carriage Return (CR `\r`) and Line Feed (LF `\n`) characters are introduced into an HTTP header from user-supplied input. By injecting the `\r\n` character sequence, an adversary could potentially modify how the response is interpreted by the client or any down stream caching services. This could allow an adve
JavaCWE-113This code directly writes an HTTP parameter to an HTTP header, which allows for a HTTP response splitting vulnerability. See http://en.wikipedia.org/wiki/HTTP_response_splitting for more information.
KotlinCWE-113When an HTTP request contains unexpected CR and LF characters, the server may respond with an output stream that is interpreted as two different HTTP responses (instead of one). An attacker can control the second response and mount attacks such as cross-site scripting and cache poisoning attacks.
KotlinCWE-113When an HTTP request contains unexpected CR and LF characters, the server may respond with an output stream that is interpreted as two different HTTP responses (instead of one). An attacker can control the second response and mount attacks such as cross-site scripting and cache poisoning attacks.
ScalaCWE-113HTTP Response Splitting is a vulnerability where Carriage Return (CR `\r`) and Line Feed (LF `\n`) characters are introduced into an HTTP header from user-supplied input. By injecting the `\r\n` character sequence, an adversary could potentially modify how the response is interpreted by the client or any downstream caching services. This could allow an adver
JavaCWE-113
