CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

Spring Framework Server Sent Event stream corruption while rendering fragments

Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

Jenkins Script Security Plugin has a script security bypass vulnerability

zbateson/mail-mime-parser has CRLF header injection via attachment filename

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

CakePHP: SmtpTransport vulnerable to CRLF header injection

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

undici vulnerable to CRLF Injection via blob-like body 'type' property

Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type

Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

Netty: STOMP CONNECT Frame Header Injection in Netty

Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

net-imap vulnerable to command Injection via unvalidated Symbol inputs

Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server

guzzlehttp/psr7 has CRLF Injection via URI Host Component

Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`

mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`

aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address