The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

What CVEs are caused by CWE-93?

127 recorded CVEs are attributed to CWE-93, including CVE-2025-61884, CVE-2026-33128, CVE-2024-51501. 1 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Is CWE-93 part of the OWASP Top 10?

CWE-93 maps to OWASP Top Ten 2007: Injection Flaws (A2) in the OWASP security taxonomy.

How do you prevent CWE-93?

Avoid using CRLF as a special sequence.

How is CWE-93 detected?

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

What are the consequences of CWE-93?

Exploiting CWE-93 can lead to: Modify Application Data.

Is CWE-93 actively exploited?

Yes. 1 CWE-93 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 127 recorded CVEs.

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

RadicalNotion.AI

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.

Vulnerable example

java

String author = request.getParameter(AUTHOR_PARAM);

Resulting query

plaintext

HTTP/1.1 200 OK

Attack input

plaintext

Wiley Hacker\r\nHTTP/1.1 200 OK\r\n

Resulting query

plaintext

HTTP/1.1 200 OK

The following code is a workflow job written using YAML. The code attempts to download pull request artifacts, unzip from the artifact called pr.zip and extract the value of the file NR into a variable "pr_number" that will be used later in another job. It attempts to create a github workflow environment variable, writing to $GITHUB_ENV. The environment variable value is retrieved from an external resource.

Vulnerable example

other

deploy:

If user input data that eventually makes it to a log message isn't checked for CRLF characters, it may be possible for an attacker to forge entries in a log file.

Vulnerable example

java

logger.info("User's street address: " + request.getParameter("streetAddress"));

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Terminology & mappings

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-93

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Related weaknesses

Parent

Child

Can precede

Related

Terminology & mappings

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-93