Skip to content
BackEsc
Sign in

CWE-93 · weakness in Injection and Smuggling

Improper Neutralization of CRLF Sequences

264 CVEs

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

check available
5
likely to be exploited
5

Every one of the 264 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Microweber < 1.2.11 - CRLF InjectionCVE-2022-0666microweber · CVSS 7.6 · 44% likely

    Microweber

  2. Apache mod_userdir CRLF injectionCVE-2016-4975Apache Software Foundation · 20% likely

    Apache

  3. OpenVPN Access Server 2.1.4 - CRLF InjectionCVE-2017-58684.6% likely
  4. Mailpit < 1.28.2 - SMTP CRLF InjectionCVE-2026-23829axllent · CVSS 5.3 · 1.4% likely

    Axllent

  5. ComfyUI-Manager < 3.39.2 - CRLF Configuration InjectionCVE-2026-22777Comfy-Org · CVSS 7.5 · 0.9% likely

    Comfy-Org

  6. Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11…CVE-2016-3115CVSS 6.4 · 36% likely
  7. A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection a…CVE-2024-20337Cisco · CVSS 8.2 · 30% likely

    Cisco

  8. New line injection during configuration editionCVE-2021-39172fiveai · CVSS 8.8 · 29% likely
  9. Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.CVE-2019-1067817% likely
  10. GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol.CVE-2018-1958515% likely
  11. An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as dem…CVE-2019-9740CVSS 6.5 · 5.4% likely
  12. An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as dem…CVE-2019-9947CVSS 5.4 · 5.3% likely
  13. Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before a…CVE-2015-90963.7% likely
  14. Improper Neutralization of CRLF Sequences in ManageEngine Desktop CentralCVE-2023-4768ManageEngine · CVSS 6.1 · 3.5% likely

    Zoho (ManageEngine)

  15. Improper Neutralization of CRLF Sequences in ManageEngine Desktop CentralCVE-2023-4767ManageEngine · CVSS 6.1 · 3.5% likely

    Zoho (ManageEngine)

  16. The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated b…CVE-2015-90973.4% likely
  17. CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subc…CVE-2017-65082.9% likely
  18. SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud ServerCVE-2022-31014nextcloud · CVSS 5.4 · 2.5% likely

    Nextcloud

  19. In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value…CVE-2018-12537The Eclipse Foundation · 2.5% likely

    Eclipse Foundation

  20. CRLF injection in httplib2CVE-2020-11078httplib2 · CVSS 6.8 · 2.4% likely
  21. CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Edition before 5.0.11 and 5.1.x before 5.1.4, and Community Editio…CVE-2014-20172.4% likely
  22. gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that c…CVE-2018-10001642.4% likely
  23. Apache Unomi log injectionCVE-2021-31164Apache Software Foundation · 2.3% likely

    Apache

  24. FTP Command Injection via CRLF in basic-ftpCVE-2026-39983patrickjuchli · CVSS 8.6 · 2.2% likely

    Patrickjuchli

  25. An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest wi…CVE-2019-97412.2% likely
  26. In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.CVE-2019-112362.1% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in