CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax
The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
Last updated
Overview
An attacker may be able to conduct cross-site scripting and other attacks against users who have these components enabled. If a product does not neutralize user controlled data being placed in the header of an HTTP response coming from the server, the header may contain a script that will get executed in the client's browser context, potentially resulting in a cross site scripting vulnerability or possibly an HTTP response splitting attack. It is important to carefully control data that is being placed both in HTTP response header and in the HTTP response body to ensure that no scripting syntax is present, taking various encodings into account.
Real-world CVEs
60 recorded CVEs are caused by CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax). The highest-severity and most recent are shown first. 25 new CWE-644 CVEs have been recorded so far in 2026 (15 in 2025).
- CVE-2023-47143
IBM Tivoli Application Dependency Discovery Manager HOST header injection
Critical · CVSS 10.0 · EPSS 54th2024-02-02 - CVE-2025-52660
HCL AION is affected by an Host Header Injection vulnerability
Critical · CVSS 9.8 · EPSS 21th2026-01-19 - CVE-2024-39736Critical · CVSS 9.8 · EPSS 29th2024-07-15
- CVE-2026-26747Critical · CVSS 9.1 · EPSS 32th2026-02-20
- CVE-2026-33805
@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
Critical · CVSS 9.0 · EPSS 37th2026-04-15 - CVE-2023-32465High · CVSS 8.8 · EPSS 52th2023-06-14
- CVE-2020-6982High · CVSS 8.8 · EPSS 63th2020-03-24
- CVE-2017-6031High · CVSS 8.8 · EPSS 85th2017-05-06
- CVE-2026-26234
JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax
High · CVSS 8.7 · EPSS 41th2026-02-12 - CVE-2025-64425
Coolify has host header injection in forgot password
High · CVSS 8.5 · EPSS 30th2026-01-05 - CVE-2025-64484
OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation
High · CVSS 8.5 · EPSS 47th2025-11-10 - CVE-2026-48126
Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir
High · CVSS 8.2 · EPSS 26th2026-05-26
Showing 12 of 60 recorded CWE-644 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-644 vulnerabilitiesCommon consequences
What can happen when CWE-644 is exploited.
Execute Unauthorized Code or Commands
Affects: Integrity, Confidentiality, Availability
Run arbitrary code.
Read Application Data
Affects: Confidentiality
Attackers may be able to obtain sensitive information.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Technologies
How to prevent it
Practical mitigations for CWE-644, grouped by where in the lifecycle they apply.
Perform output validation in order to filter/escape/encode unsafe data that is being passed from the server in an HTTP response header.
Disable script execution functionality in the clients' browser.
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
In the following Java example, user-controlled data is added to the HTTP headers and returned to the client. Given that the data is not subject to neutralization, a malicious user may be able to inject dangerous scripting tags that will lead to script execution in the client browser.
Vulnerable example
response.addHeader(HEADER_NAME, untrustedRawInputData);Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2006-3918 — Web server does not remove the Expect header from an HTTP request when it is reflected back in an error message, allowing a Flash SWF file to perform XSS attacks.
Terminology & mappings
Mapped taxonomies
- Software Fault Patterns: Tainted input to command (SFP24)
Frequently asked questions
Common questions about CWE-644.
- What is CWE-644?
- The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
- What CVEs are caused by CWE-644?
- 60 recorded CVEs are attributed to CWE-644, including CVE-2023-47143, CVE-2025-52660, CVE-2024-39736.
- How do you prevent CWE-644?
- Perform output validation in order to filter/escape/encode unsafe data that is being passed from the server in an HTTP response header.
- What are the consequences of CWE-644?
- Exploiting CWE-644 can lead to: Execute Unauthorized Code or Commands, Read Application Data.
- Is CWE-644 actively exploited?
- 60 recorded CVEs are caused by CWE-644; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-644) (opens in a new tab)
- CWE-644 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-644
Get alerted the moment a new CWE-644 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.