CWE-93
AllowedImproper Neutralization of CRLF Sequences ('CRLF Injection')
Abstraction: Base · Status: Draft
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
385 vulnerabilities reference this CWE, most recent first.
GHSA-Q86F-FMQF-QRF6
Vulnerability from github – Published: 2017-10-24 18:33 – Updated: 2023-09-05 21:08The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "mail"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-9097"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:51:27Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.",
"id": "GHSA-q86f-fmqf-qrf6",
"modified": "2023-09-05T21:08:32Z",
"published": "2017-10-24T18:33:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9097"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/issues/215"
},
{
"type": "WEB",
"url": "https://github.com/mikel/mail/pull/1097"
},
{
"type": "WEB",
"url": "https://github.com/mikel/mail/commit/72befdc4dab3e6e288ce226a7da2aa474cf5be83"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/137631"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-q86f-fmqf-qrf6"
},
{
"type": "PACKAGE",
"url": "https://github.com/mikel/mail"
},
{
"type": "WEB",
"url": "https://rubysec.com/advisories/mail-OSVDB-131677"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2015/12/11/3"
},
{
"type": "WEB",
"url": "http://www.mbsd.jp/Whitepaper/smtpi.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mail Gem CRLF Injection vulnerability"
}
GHSA-Q89X-F52W-6HJ2
Vulnerability from github – Published: 2021-08-25 20:43 – Updated: 2023-06-13 17:39Serializing of headers to the socket did not filter the values for newline bytes (\r or \n), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input.
This issue was fixed by replacing all newline characters with a space during serialization of a header value.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "hyper"
},
"ranges": [
{
"events": [
{
"introduced": "0.10.0"
},
{
"fixed": "0.10.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "hyper"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-18587"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-19T21:25:19Z",
"nvd_published_at": "2019-08-26T13:15:00Z",
"severity": "MODERATE"
},
"details": "Serializing of headers to the socket did not filter the values for newline bytes (\\r or \\n), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input.\n\nThis issue was fixed by replacing all newline characters with a space during serialization of a header value.",
"id": "GHSA-q89x-f52w-6hj2",
"modified": "2023-06-13T17:39:45Z",
"published": "2021-08-25T20:43:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18587"
},
{
"type": "PACKAGE",
"url": "https://github.com/hyperium/hyper"
},
{
"type": "WEB",
"url": "https://github.com/hyperium/hyper/wiki/Security-001"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2017-0002.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Headers containing newline characters can split messages in hyper"
}
GHSA-Q8RV-95X3-46J5
Vulnerability from github – Published: 2026-08-31 09:30 – Updated: 2026-08-31 09:30Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.
{
"affected": [],
"aliases": [
"CVE-2026-82853"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-31T09:17:05Z",
"severity": "MODERATE"
},
"details": "Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.",
"id": "GHSA-q8rv-95x3-46j5",
"modified": "2026-08-31T09:30:30Z",
"published": "2026-08-31T09:30:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-vvjj-xcjg-gr5g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82853"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/nodemailer-before-8.0.5-smtp-command-injection-via-crlf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QCQR-HCJQ-WHFQ
Vulnerability from github – Published: 2022-05-17 00:15 – Updated: 2022-07-12 22:14CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.1.0.Final"
},
"package": {
"ecosystem": "Maven",
"name": "org.wildfly:wildfly-undertow"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0.Final"
},
{
"fixed": "11.0.0.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-4993"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-12T22:14:44Z",
"nvd_published_at": "2016-09-26T14:59:00Z",
"severity": "MODERATE"
},
"details": "CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.",
"id": "GHSA-qcqr-hcjq-whfq",
"modified": "2022-07-12T22:14:44Z",
"published": "2022-05-17T00:15:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4993"
},
{
"type": "WEB",
"url": "https://github.com/undertow-io/undertow/commit/834496fb74ddda2af197940c70d08bab419fdf12"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3454"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3455"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3456"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3458"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1344321"
},
{
"type": "WEB",
"url": "https://issues.redhat.com/browse/UNDERTOW-827"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1838.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1839.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1840.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1841.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Neutralization of CRLF Sequences in Wildfly Undertow"
}
GHSA-QFCM-R8PP-MRFM
Vulnerability from github – Published: 2023-09-29 06:30 – Updated: 2024-04-04 07:58All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.
{
"affected": [],
"aliases": [
"CVE-2023-26148"
],
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-29T05:15:46Z",
"severity": "MODERATE"
},
"details": "All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \\r\\n (carriage return line feeds) characters and inject additional headers in the request sent.",
"id": "GHSA-qfcm-r8pp-mrfm",
"modified": "2024-04-04T07:58:01Z",
"published": "2023-09-29T06:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26148"
},
{
"type": "WEB",
"url": "https://gist.github.com/dellalibera/65d136066fdd5ea4dddaadaa9b0ba90e"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730769"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QH6H-825Q-Q4MX
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems (using callback).
{
"affected": [],
"aliases": [
"CVE-2017-7528"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-22T16:29:00Z",
"severity": "MODERATE"
},
"details": "Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems (using callback).",
"id": "GHSA-qh6h-825q-q4mx",
"modified": "2022-05-13T01:36:18Z",
"published": "2022-05-13T01:36:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7528"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7528"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105143"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QJ5R-2R5P-PHC7
Vulnerability from github – Published: 2025-08-06 18:31 – Updated: 2025-09-17 20:23Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-m4j5-5x4r-2xp9. This link is maintained to preserve external references.
Original Description
A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "26.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-06T20:44:17Z",
"nvd_published_at": "2025-08-06T17:15:38Z",
"severity": "MODERATE"
},
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-m4j5-5x4r-2xp9. This link is maintained to preserve external references.\n\n### Original Description\nA vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw\u0027s only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.",
"id": "GHSA-qj5r-2r5p-phc7",
"modified": "2025-09-17T20:23:58Z",
"published": "2025-08-06T18:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8419"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15336"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15337"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15338"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15339"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-8419"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2385776"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: Keycloak-services SMTP Inject Vulnerability",
"withdrawn": "2025-09-17T20:23:58Z"
}
GHSA-QPMX-3RFJ-7RHV
Vulnerability from github – Published: 2026-05-27 20:42 – Updated: 2026-05-27 20:42Description
Symfony\Component\Mime\Address is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary.
The constructor accepts email addresses whose local-part (the part before @) is an RFC-5322 quoted string containing raw \r\n bytes, e.g. "x\r\nBcc: attacker@evil"@example.com. The stored address is later emitted verbatim into (1) the rendered message headers and (2) SmtpTransport's MAIL FROM:<...> / RCPT TO:<...> protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command.
Resolution
The Address constructor now rejects addresses containing line breaks.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/mime"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.4.52"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/symfony"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.4.52"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/mime"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.4.40"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/mime"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.4.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/mime"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/symfony"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.4.40"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/symfony"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.4.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/symfony"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45067"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-27T20:42:07Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Description\n\n`Symfony\\Component\\Mime\\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary.\n\nThe constructor accepts email addresses whose local-part (the part before `@`) is an RFC-5322 *quoted string* containing raw `\\r\\n` bytes, e.g. `\"x\\r\\nBcc: attacker@evil\"@example.com`. The stored address is later emitted verbatim into (1) the rendered message headers and (2) `SmtpTransport`\u0027s `MAIL FROM:\u003c...\u003e` / `RCPT TO:\u003c...\u003e` protocol lines, turning the embedded CRLF into a new mail header and/or a new SMTP command.\n\n### Resolution\n\nThe `Address` constructor now rejects addresses containing line breaks.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604) for branch 5.4.\n\n### Credits\n\nWe would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.",
"id": "GHSA-qpmx-3rfj-7rhv",
"modified": "2026-05-27T20:42:07Z",
"published": "2026-05-27T20:42:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-qpmx-3rfj-7rhv"
},
{
"type": "WEB",
"url": "https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2026-45067.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45067.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/symfony/symfony"
},
{
"type": "WEB",
"url": "https://symfony.com/cve-2026-45067"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\\Component\\Mime\\Address"
}
GHSA-QRR6-MG7R-M243
Vulnerability from github – Published: 2026-04-18 00:59 – Updated: 2026-05-12 13:33Impact
PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives.
An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process.
Sources of INI values that participate in the attack:
<ini name="…" value="…"/>entries inphpunit.xml/phpunit.xml.dist- INI settings inherited from the host PHP runtime via
ini_get_all()
Threat Model
Exploitation requires the attacker to control the content of an INI value read by PHPUnit. In practice this means write access to the project's phpunit.xml, the host php.ini, or the PHP binary's environment. The most realistic exposure is Poisoned Pipeline Execution (PPE): a pull request from an untrusted contributor that modifies phpunit.xml to include a newline-containing INI value, executed by a CI system that runs PHPUnit against the PR without isolation. A malicious newline is not visibly distinguishable from a legitimate value in a typical diff review.
Affected component
PHPUnit\Util\PHP\JobRunner::settingsToParameters().
Patches
The fix has two parts:
1. Reject line-break characters
Because a newline or carriage return in an INI value has no legitimate use and is the primitive that enables directive injection, any PHP setting value containing \n or \r is now rejected with an explicit PhpProcessException. This follows the same "visibility over silence" principle applied in CVE-2026-24765: the anomalous state fails loudly in CI output rather than being silently sanitized, giving operators an opportunity to investigate whether it reflects tampering, environment contamination, or an unexpected upstream change.
2. Quote remaining metacharacters
Values containing " or ;, both of which have legitimate uses (e.g., regex-valued INI settings such as ddtrace's datadog.appsec.obfuscation_parameter_value_regexp), are wrapped in double quotes with inner " escaped as \", so PHP's INI parser reads them as literal string contents rather than comment/delimiter tokens. Plain values are forwarded unchanged so that boolean keywords (On/Off) and bitwise expressions (E_ALL & ~E_NOTICE) retain their INI semantics.
Workarounds
If upgrading is not immediately possible:
- Audit INI values: Ensure no
<ini value="…">entry inphpunit.xml/phpunit.xml.distcontains newline,", or;characters, and that nothing writes such values into configuration at build time. - Isolate CI execution of untrusted code: Run PHPUnit against pull requests only in ephemeral, containerized runners that discard filesystem state between jobs; require human review before executing PRs from forks; enforce branch protection on workflows that handle secrets (
pull_request_targetand similar). These mitigations apply to the broader PPE risk class and are effective against this vulnerability as well. - Restrict who can modify
phpunit.xml: Treatphpunit.xmlas security-sensitive in code review, particularly<ini>entries. - Sanitize host INI: Ensure the host PHP's
php.inidoes not contain values with embedded newlines or unescaped metacharacters.
References
- Fix: https://github.com/sebastianbergmann/phpunit/pull/6592
- Related advisory (same threat class, Poisoned Pipeline Execution): GHSA-vvj3-c3rp-c85p / CVE-2026-24765
- OWASP CI/CD Top 10: CICD-SEC-04 Poisoned Pipeline Execution
- CWE-88: https://cwe.mitre.org/data/definitions/88.html
- CWE-93: https://cwe.mitre.org/data/definitions/93.html
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpunit/phpunit"
},
"ranges": [
{
"events": [
{
"introduced": "12.5.21"
},
{
"fixed": "12.5.22"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"12.5.21"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpunit/phpunit"
},
"ranges": [
{
"events": [
{
"introduced": "13.1.5"
},
{
"fixed": "13.1.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"13.1.5"
]
}
],
"aliases": [
"CVE-2026-41570"
],
"database_specific": {
"cwe_ids": [
"CWE-88",
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-18T00:59:28Z",
"nvd_published_at": "2026-05-08T15:16:40Z",
"severity": "HIGH"
},
"details": "## Impact\n\nPHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as `-d name=value` command-line arguments without neutralizing INI metacharacters. Because PHP\u0027s INI parser interprets `\"` as a string delimiter, `;` as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives.\n\nAn attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child\u0027s configuration, including `auto_prepend_file`, `extension`, `disable_functions`, `open_basedir`, and others. Setting `auto_prepend_file` to an attacker-controlled path yields remote code execution in the child process.\n\nSources of INI values that participate in the attack:\n\n- `\u003cini name=\"\u2026\" value=\"\u2026\"/\u003e` entries in `phpunit.xml` / `phpunit.xml.dist`\n- INI settings inherited from the host PHP runtime via `ini_get_all()`\n\n### Threat Model\n\nExploitation requires the attacker to control the content of an INI value read by PHPUnit. In practice this means write access to the project\u0027s `phpunit.xml`, the host `php.ini`, or the PHP binary\u0027s environment. The most realistic exposure is [Poisoned Pipeline Execution](https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution) (PPE): a pull request from an untrusted contributor that modifies `phpunit.xml` to include a newline-containing INI value, executed by a CI system that runs PHPUnit against the PR without isolation. A malicious newline is not visibly distinguishable from a legitimate value in a typical diff review.\n\n### Affected component\n\n`PHPUnit\\Util\\PHP\\JobRunner::settingsToParameters()`.\n\n## Patches\n\nThe fix has two parts:\n\n**1. Reject line-break characters**\n\nBecause a newline or carriage return in an INI value has no legitimate use and is the primitive that enables directive injection, any PHP setting value containing `\\n` or `\\r` is now rejected with an explicit `PhpProcessException`. This follows the same \"visibility over silence\" principle applied in [CVE-2026-24765](https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p): the anomalous state fails loudly in CI output rather than being silently sanitized, giving operators an opportunity to investigate whether it reflects tampering, environment contamination, or an unexpected upstream change.\n\n**2. Quote remaining metacharacters**\n\nValues containing `\"` or `;`, both of which have legitimate uses (e.g., regex-valued INI settings such as `ddtrace`\u0027s `datadog.appsec.obfuscation_parameter_value_regexp`), are wrapped in double quotes with inner `\"` escaped as `\\\"`, so PHP\u0027s INI parser reads them as literal string contents rather than comment/delimiter tokens. Plain values are forwarded unchanged so that boolean keywords (`On`/`Off`) and bitwise expressions (`E_ALL \u0026 ~E_NOTICE`) retain their INI semantics.\n\n## Workarounds\n\nIf upgrading is not immediately possible:\n\n- Audit INI values: Ensure no `\u003cini value=\"\u2026\"\u003e` entry in `phpunit.xml` / `phpunit.xml.dist` contains newline, `\"`, or `;` characters, and that nothing writes such values into configuration at build time.\n- Isolate CI execution of untrusted code: Run PHPUnit against pull requests only in ephemeral, containerized runners that discard filesystem state between jobs; require human review before executing PRs from forks; enforce branch protection on workflows that handle secrets (`pull_request_target` and similar). These mitigations apply to the broader PPE risk class and are effective against this vulnerability as well.\n- Restrict who can modify `phpunit.xml`: Treat `phpunit.xml` as security-sensitive in code review, particularly `\u003cini\u003e` entries.\n- Sanitize host INI: Ensure the host PHP\u0027s `php.ini` does not contain values with embedded newlines or unescaped metacharacters.\n\n## References\n\n- Fix: https://github.com/sebastianbergmann/phpunit/pull/6592\n- Related advisory (same threat class, Poisoned Pipeline Execution): [GHSA-vvj3-c3rp-c85p / CVE-2026-24765](https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p)\n- OWASP CI/CD Top 10: [CICD-SEC-04 Poisoned Pipeline Execution](https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution)\n- CWE-88: https://cwe.mitre.org/data/definitions/88.html\n- CWE-93: https://cwe.mitre.org/data/definitions/93.html",
"id": "GHSA-qrr6-mg7r-m243",
"modified": "2026-05-12T13:33:34Z",
"published": "2026-04-18T00:59:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41570"
},
{
"type": "WEB",
"url": "https://github.com/sebastianbergmann/phpunit/pull/6592"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2026-41570.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/sebastianbergmann/phpunit"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes"
}
GHSA-R256-59W3-3GR2
Vulnerability from github – Published: 2026-04-22 09:31 – Updated: 2026-04-22 09:31The HTTP Headers plugin for WordPress is vulnerable to CRLF Injection in all versions up to, and including, 1.19.2. This is due to insufficient sanitization of custom header name and value fields before writing them to the Apache .htaccess file via insert_with_markers(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary newline characters and additional Apache directives into the .htaccess configuration file via the 'Custom Headers' settings, leading to Apache configuration parse errors and potential site-wide denial of service.
{
"affected": [],
"aliases": [
"CVE-2026-2717"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-22T09:16:20Z",
"severity": "MODERATE"
},
"details": "The HTTP Headers plugin for WordPress is vulnerable to CRLF Injection in all versions up to, and including, 1.19.2. This is due to insufficient sanitization of custom header name and value fields before writing them to the Apache .htaccess file via `insert_with_markers()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary newline characters and additional Apache directives into the .htaccess configuration file via the \u0027Custom Headers\u0027 settings, leading to Apache configuration parse errors and potential site-wide denial of service.",
"id": "GHSA-r256-59w3-3gr2",
"modified": "2026-04-22T09:31:32Z",
"published": "2026-04-22T09:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2717"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1098"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L745"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1098"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L745"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7716e77f-e899-4046-9421-86fc0c36c245?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Avoid using CRLF as a special sequence.
Mitigation
Appropriately filter or quote CRLF sequences in user-controlled input.
CAPEC-15: Command Delimiters
An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.