CWE-113

131 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 6High 27Medium 79Low 18Not scored 1

CVEs per yearBy the year they were published

CVE-2026-73117
Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data
Apache Software Foundation · Apache Juneau
Critical10.0
CVE-2026-108767
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM · Db2 Genius Hub
Medium4.3
CVE-2026-120639
CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push
CGI
Not scored
CVE-2026-112880
CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
benoitc · hackney
Low2.1
CVE-2026-55486
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
intranda · goobi-viewer-core
Critical9.3
CVE-2026-103930
cpp-httplib open_stream serializes CRLF in request target into HTTP request line
yhirose · cpp-httplib
Low3.7
CVE-2026-85976
HTTP response splitting in Progress MarkLogic Server Query Console
Progress Software Corporation · MarkLogic Server
Medium5.4
CVE-2026-105324
An HTTP header injection vulnerability was found in the ADM
ASUSTOR Inc. · ADM
Critical9.2
CVE-2026-106512
MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS
MISP · sachertortephp
High8.4
CVE-2026-93711
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array
Dancer2
Medium6.5