Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services outside their contact groups and occupying web server and Livestatus workers for an attacker-controlled duration.
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.
A CRLF injection vulnerability exists in Laravel framework versions prior to 12.60.0 and 13.10.0. This vulnerability affects email validation combined with Symfony Mailer and Mime handling, potentially allowing unauthenticated attackers to interfere with outbound email processing when sending mail to user-supplied addresses. The issue has been patched in versions 12.60.0 and 13.10.0.
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
### Summary
HTTPX2 serializes the per-file `Content-Type` and custom headers supplied through the `files=` tuple API directly into the `multipart/form-data` body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to terminate a multipart part header and inject additional part headers or end the part header block early.
### Details
The three-element file tuple accepts `(filename, content, content_type)`, and the four-element form accepts `(filename, content, content_type, headers)`. `FileField.render_headers()` interpolates the supplied header names and values between CRLF delimiters without validating them.
For example:
```python
import httpx2
request = httpx2.Request(
"POST",
"https://example.com/upload",
headers={"Content-Type": "multipart/form-data; boundary=BOUNDARY"},
files={
"file": (
"safe.txt",
b"payload",
"text/plain\r\nX-Injected: true",
)
},
)
print(request.read().decode())
```
The generated body contains an attacker-injected part header:
```text
--BOUNDARY
Content-Disposition: form-data; name="file"; filename="safe.txt"
Content-Type: text/plain
X-Injected: true
payload
--BOUNDARY--
```
The same issue affects names and values in the custom header mapping from the four-element tuple.
Field names and filenames are serialized through a separate escaping path and do not permit CRLF header injection.
### Impact
Applications are affected when they pass attacker-controlled upload metadata into the per-file `content_type` or custom `headers` arguments. The receiving server interprets injected lines as genuine multipart part headers. Depending on how that server validates and processes uploads, this can alter part semantics or bypass checks based on part headers.
This does not split the outer HTTP request: the injected headers are contained within the multipart body. The concrete security impact therefore depends on the downstream multipart parser and application behavior.
### Mitigation
Upgrade to HTTPX2 `2.11.0` or later. Patched versions reject forbidden control characters in multipart part header names and values and raise `ValueError` before serializing the request.
If upgrading is not immediately possible, applications should validate custom multipart header names as HTTP field-name tokens. They should reject NUL, CR, LF, other C0 controls except horizontal tab, and DEL in per-file content types and custom header values before passing them to HTTPX2.
cpp-httplib versions from 0.49.0 up to but not including 0.50.0 contain a CRLF injection vulnerability in the chunked-response trailer output path. This occurs because trailer header names and values are written directly to the socket without validation, allowing injection of carriage return and line feed sequences. This flaw enables HTTP response splitting, which can allow an attacker to forge response headers or inject a second HTTP response. The issue is fixed in version 0.50.0.
CVE-2026-59313 is a critical vulnerability in the Spring Framework affecting versions from 5.3.0 through 7.0.8. It involves improper neutralization of CRLF sequences (CRLF Injection) in Spring MVC applications using the functional web framework, specifically when handling Server-Sent Events (SSE). This flaw can lead to stream corruption and impacts confidentiality, integrity, and availability.
CVE-2026-47890 is a critical vulnerability in the Spring Framework affecting versions 6.2.0 through 6.2.19 and 7.0.0 through 7.0.8. It involves improper neutralization of CRLF sequences (CRLF Injection) that can cause stream corruption when using Server-Sent Events (SSE) with view fragments in Spring MVC and WebFlux applications. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-54511 is a high-severity vulnerability in the dahlia logtape logging library. Prior to versions 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package improperly handles control characters and structured data keys, allowing CRLF injection. This can enable attackers to forge syslog records with arbitrary metadata, undermining log integrity. The issue is fixed in the specified versions.
CVE-2026-77550 is a critical vulnerability in Ubiquiti Inc's UniFi OS Server involving improper neutralization of CRLF sequences (CRLF injection). This flaw allows a malicious actor with network access to potentially bypass authentication on affected UniFi OS devices or instances. The vulnerability has a maximum CVSS score of 10, indicating severe impact on confidentiality, integrity, and availability. No specific affected versions or patches have been provided yet, and no known exploits are reported in the wild.
CVE-2026-77549 is a critical vulnerability in Ubiquiti Inc's UniFi OS Server involving improper neutralization of CRLF sequences (CRLF injection). An attacker with network access could exploit this flaw under certain conditions to bypass authentication on affected UniFi OS devices or instances. The vulnerability has a high CVSS score of 9.0, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.
CVE-2026-75922 is a medium severity vulnerability in Reverse::Proxy for Perl versions before 0.04 that allows HTTP request smuggling. The issue arises because the proxy percent-decodes PATH_INFO before forwarding it upstream without re-encoding, enabling an attacker to inject CRLF sequences that split the request line. This causes the upstream server to interpret additional attacker-controlled requests on a reused keep-alive connection, potentially bypassing proxy routing restrictions.
CVE-2026-75484 is a CRLF injection vulnerability in the mtrudel bandit HTTP/2 header processing. It allows unauthenticated remote attackers to inject carriage return, line feed, or null characters into application-visible request headers. The vulnerability arises because the HTTP/2 header decoder (HPACK) does not validate field values for these characters, unlike the HTTP/1 path. The issue affects bandit versions from 1.4.0 up to but not including 1.12.5. The risk depends on how downstream applications use these header values, such as logging or forwarding them. A related issue with duplicate :authority pseudo-headers was also fixed. The CVSS 4.0 base score is 6.9 (medium severity).
aiosmtplib versions prior to 5.1.1 contain a command injection vulnerability in several SMTP methods that accept caller-supplied addresses. These methods do not reject embedded carriage return (CR) or line feed (LF) characters, allowing attackers to inject additional SMTP commands. This can lead to desynchronization of the SMTP command-response pipeline, hanging the SMTP instance, or sending arbitrary messages without control of the SMTP server. The issue is fixed in version 5.1.1.
CVE-2026-71573 is a vulnerability in Joomla! CMS involving improper CORS origin validation in versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. This flaw allows certain CORS requests to bypass origin checks due to improper implementation. The issue is classified as CWE-93, related to improper neutralization of CRLF sequences. The vulnerability has a CVSS 4.0 base score of 6.9, indicating high severity.
CVE-2026-71572 is a medium severity vulnerability in Joomla! CMS affecting versions 3.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It involves improper neutralization of CRLF sequences leading to response header injection in download views. This flaw allows reflected file download or content-type confusion due to lack of output processing in multiple download views.
A vulnerability in rsync before version 3.5.0 allows local attackers to inject newline characters into user or group names used in the uid/gid mapping interface. This newline injection can cause the rsync daemon to misinterpret protocol messages, potentially corrupting the uid/gid mapping logic. The issue is classified as CWE-93 (Improper Neutralization of CRLF Sequences).