Skip to content
Threat Feed
Subscribe

Tag

Crlf-Injection

4 briefs RSS
high threat

Symfony Email Header / SMTP Command Injection via CRLF Characters

Symfony's Mime Address component is susceptible to email header and SMTP command injection due to accepting CRLF characters within email addresses, leading to potential header manipulation or unauthorized SMTP commands in symfony/mime and symfony/symfony versions prior to 5.4.52, versions 6.0.0 to before 6.4.40, versions 7.0.0 to before 7.4.12 and versions 8.0.0 to before 8.0.12.

symfony/mime +1 crlf-injection email-injection symfony CVE-2026-45067
2r 1t
critical threat

CVE-2026-1502 HTTP Client Proxy Tunnel Headers CR/LF Injection Vulnerability

CVE-2026-1502 is a critical vulnerability in Microsoft HTTP client proxy tunnel header validation, potentially allowing for CR/LF injection attacks.

crlf-injection http-request-smuggling proxy-vulnerability cve
2r 1t 1c
high advisory

Openfind MailGates/MailAudit CRLF Injection Vulnerability

Openfind MailGates/MailAudit is vulnerable to CRLF injection (CVE-2026-6351), enabling unauthenticated remote attackers to read system files by injecting malicious CRLF sequences.

crlf-injection vulnerability mailgates mailaudit
2r 1t 1c
medium advisory

i18next-http-middleware HTTP Response Splitting and DoS Vulnerability

i18next-http-middleware versions before 3.9.3 are vulnerable to HTTP response splitting and denial-of-service attacks due to unsanitized Content-Language headers, potentially leading to session fixation, cache poisoning, reflected XSS, or complete service disruption depending on the Node.js version.

i18next-http-middleware crlf-injection http-response-splitting denial-of-service i18next
2r 1t