HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-73117 is a critical HTTP Response Splitting vulnerability in Apache Juneau through version 9.2.0. The issue arises because response header values and redirect targets passed to the servlet container are not properly sanitized, allowing remote attackers to inject malicious header lines or redirect users to arbitrary external sites. The vulnerability depends on application code that uses request data to set headers or redirects. Apache Juneau version 9.2.1 addresses this by sanitizing header values by default and introducing a safer redirect method.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows remote authenticated attackers to perform HTTP response splitting due to improper neutralization of HTTP headers. This vulnerability is identified as CWE-113 and has a medium severity rating with a CVSS score of 4.3.
CGI versions prior to 5.00 for Perl contain an HTTP request splitting vulnerability due to improper handling of HTTP header values. The vulnerability arises from entity decoding after newline checks and lack of validation in multipart_start and do_push functions, allowing injection of encoded carriage return or line feed characters into HTTP headers. This can enable an attacker to add headers or split the HTTP response when request data is passed into these header values.
CVE-2026-112880 is an HTTP Request Splitting vulnerability in the hackney_http_connect module of benoitc hackney. It occurs when the proxy_auth_fun callback returns a value containing CR, LF, or NUL bytes that are not properly sanitized before being inserted into the Proxy-Authorization header during an HTTP CONNECT retry. This allows injection of additional header lines in requests sent to the proxy. The vulnerability affects versions from 2.0.0 up to but not including 4.9.0 and has a low severity rating.
CVE-2026-55486 is a critical cross-site scripting (XSS) vulnerability in the intranda goobi-viewer-core web application. It affects versions from 25.08 up to but not including 26.05. The vulnerability arises because the IIIF Auth 2.0 endpoints auth/login and auth/token accept an origin query parameter without proper validation, which is then embedded unsafely into the Content-Security-Policy header and HTML response body, enabling reflected XSS attacks. The issue has been fixed in version 26.05.
cpp-httplib versions from 0.29.0 up to but not including 0.51.0 contain an HTTP request/response splitting vulnerability due to improper neutralization of CRLF sequences in HTTP headers. The issue arises because Client::open_stream accepts a path that bypasses encoding protections, allowing injection of crafted request metadata. Exploitation requires the application to pass remote user input into this vulnerable path and a backend or intermediary that processes the injected data. The vulnerability impacts integrity by enabling modification of backend-visible request data but does not directly affect confidentiality or availability. This vulnerability is fixed in version 0.51.0.
CVE-2026-85976 is a medium severity vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, do not properly sanitize input to the Query Console file-exploration endpoint. This improper neutralization of CRLF sequences in HTTP headers can lead to HTTP response splitting, potentially causing unintended client-side response handling.
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's X-Sendfile mechanism to retrieve sensitive files without authentication.
Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RWC1 as well as from ADM 5.0.0 through ADM 5.1.4.RL21.
CVE-2026-106512 is a high-severity vulnerability in the MISP sachertortephp component where the CakeResponse::download() method improperly sanitizes filenames used in the Content-Disposition HTTP header. This flaw allows an authenticated user to craft filenames that inject HTTP header content, leading to stored cross-site scripting (XSS) when other users view affected pages. The vulnerability arises from two injection vectors: control characters causing header omission and double-quote characters enabling header parameter injection. Exploitation can result in session hijacking, data exfiltration, and unauthorized actions within the application context.
Dancer2 versions before 2.2.0 for Perl contain a vulnerability where CR and LF characters are not stripped from HTTP response header names. This allows an attacker controlling header names to inject additional headers by splitting the HTTP response. The vulnerability is classified as CWE-113, HTTP Response Splitting, and has a medium severity with a CVSS score of 6.5.
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1.
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers.
cpp-httplib versions from 0.49.0 up to but not including 0.50.0 contain a CRLF injection vulnerability in the chunked-response trailer output path. This occurs because trailer header names and values are written directly to the socket without validation, allowing injection of carriage return and line feed sequences. This flaw enables HTTP response splitting, which can allow an attacker to forge response headers or inject a second HTTP response. The issue is fixed in version 0.50.0.
CVE-2026-59314 is a medium-severity vulnerability in the Spring Framework where applications that construct a Content-Disposition HTTP header from untrusted input may be susceptible to HTTP response splitting attacks. This occurs when malicious file names containing CRLF sequences are used. The vulnerability affects multiple versions of Spring Framework from 5.2.25.RELEASE and earlier up to 7.0.8.
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The build_inner_header function interpolates the uri, host, accept_type, content_type, content_length, USER_AGENT, and insurant_id values into request lines and headers, including x-useragent and x-insurantid. An authenticated attacker who controls a value can inject additional headers into the inner request. Depending on ePA server handling, an injected x-insurantid header can expose another patient's records, and injected Authorization headers can bypass the intended authentication or authorization context. Session-derived USER_AGENT input can also poison requests across the session. This issue is fixed in version 1.3.0.
secure_headers versions prior to 7.3.0 contain a vulnerability where untrusted input can be injected into Content-Security-Policy (CSP) directives without proper sanitization. This improper neutralization allows attackers to insert malicious CSP directives such as script-src 'unsafe-inline', potentially enabling cross-site scripting (XSS) attacks or CSP report exfiltration. The issue is resolved in version 7.3.0.
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, including Remote::request(), Remote::get(), and Remote::post(), to send outgoing HTTP requests with untrusted data in the headers option could allow newline characters in a header value to inject a separate unintended request header to the remote service. This issue is fixed in versions 4.9.4 and 5.4.4.
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x, for example with Message::toString() or an equivalent serializer, the serialized message could contain attacker-controlled header lines. The issue can also be reached through Message::parseRequest() or Message::parseResponse() when malformed raw messages are parsed into first-party PSR-7 objects and then serialized again. Creating or modifying a Request, Response, or other PSR-7 object alone is not sufficient. The issue requires the malformed message to be serialized and written to the network, forwarded, replayed, or otherwise processed by software that does not independently reject the malformed start line. This vulnerability is fixed in 2.12.1.