Common Weakness Enumeration
CWE-93
Weakness AllowedImproper Neutralization of CRLF Sequences
Abstraction: Base · Status: Draft
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Content history
Submission: PLOVER
· 2006-07-19
· CWE Draft 3
Modification: Sean Eidemiller
· Cigital
· 2008-07-01
· CWE 1.0
added/updated demonstrative examples
Modification: Eric Dalci
· Cigital
· 2008-07-01
· CWE 1.0
updated Time_of_Introduction
Modification: CWE Content Team
· MITRE
· 2008-09-08
· CWE 1.0
updated Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2009-03-10
· CWE 1.3
updated References
Modification: CWE Content Team
· MITRE
· 2009-05-27
· CWE 1.4
updated Name
Modification: CWE Content Team
· MITRE
· 2009-10-29
· CWE 1.6
updated Other_Notes
Modification: CWE Content Team
· MITRE
· 2009-12-28
· CWE 1.7
updated Likelihood_of_Exploit
Modification: CWE Content Team
· MITRE
· 2010-02-16
· CWE 1.8
updated Related_Attack_Patterns, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2010-04-05
· CWE 1.8.1
updated Related_Attack_Patterns
Modification: CWE Content Team
· MITRE
· 2010-06-21
· CWE 1.9
updated Description, Name
Modification: CWE Content Team
· MITRE
· 2011-03-29
· CWE 1.12
updated Description
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Relationships
Modification: CWE Content Team
· MITRE
· 2012-10-30
· CWE 2.3
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2014-07-30
· CWE 2.8
updated Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2015-12-07
· CWE 2.9
updated Relationships
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Applicable_Platforms, Causal_Nature, Likelihood_of_Exploit, Modes_of_Introduction, References, Relationships
Modification: CWE Content Team
· MITRE
· 2019-06-20
· CWE 3.3
updated Relationships
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Relationships
Modification: CWE Content Team
· MITRE
· 2021-10-28
· CWE 4.6
updated Relationships
Modification: CWE Content Team
· MITRE
· 2022-04-28
· CWE 4.7
updated Research_Gaps
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Description
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Detection_Factors, Relationships, Time_of_Introduction
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2024-11-19
· CWE 4.16
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2025-04-03
· CWE 4.17
updated Diagram, References
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Demonstrative_Examples, Relationships
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Alternate_Terms, Name
499 vulnerabilities reference this CWE, most recent first.
CVE-2026-123095 (GCVE-0-2026-123095)
Vulnerability from cvelistv5 – Published: 2026-11-05 15:11 – Updated: 2026-11-05 15:11
VLAI
EPSS
VEX
Title
mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines
Summary
mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution.
Severity
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/mpv-player/mpv/pull/18762 | issue-trackingpatch |
| https://github.com/mpv-player/mpv/commit/c3096515… | patch |
| https://github.com/mpv-player/mpv/blob/v0.41.0/pl… | technical-description |
| https://github.com/mpv-player/mpv/blob/v0.41.0/pl… | technical-description |
| https://github.com/mpv-player/mpv/releases/tag/v0.42.0 | release-notes |
| https://github.com/mpv-player/mpv | product |
| https://www.vulncheck.com/advisories/mpv-0.29.0-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mpv-player | mpv |
Affected:
0.29.0 , < 0.42.0
(semver)
cpe:2.3:a:mpv:mpv:*:*:*:*:*:*:*:* |
Date Public
2026-11-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/mpv-player/mpv",
"product": "mpv",
"repo": "https://github.com/mpv-player/mpv",
"vendor": "mpv-player",
"versions": [
{
"lessThan": "0.42.0",
"status": "affected",
"version": "0.29.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mpv:mpv:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.42.0",
"versionStartIncluding": "0.29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dilanka Kaushal Hewage (r3vpwnx)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Kacper Michaj\u0142ow (kasper93)"
}
],
"datePublic": "2026-11-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:11:49.933Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/mpv-player/mpv/pull/18762"
},
{
"tags": [
"patch"
],
"url": "https://github.com/mpv-player/mpv/commit/c3096515dcd26c14004f985538b5aa41db613856"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L244-L251"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L1115-L1137"
},
{
"name": "mpv v0.42.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/mpv-player/mpv/releases/tag/v0.42.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/mpv-player/mpv"
},
{
"name": "VulnCheck Advisory: mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mpv-0.29.0-before-0.42.0-playlist-entry-injection-via-ytdl-hook-newlines"
}
],
"title": "mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123095",
"datePublished": "2026-11-05T15:11:49.933Z",
"dateReserved": "2026-11-05T12:22:13.130Z",
"dateUpdated": "2026-11-05T15:11:49.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121946 (GCVE-0-2026-121946)
Vulnerability from cvelistv5 – Published: 2026-11-04 12:31 – Updated: 2026-11-04 18:49
VLAI
EPSS
VEX
Title
zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders
Summary
zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:48 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/zbateson/mail-mime-parser/secu… | vendor-advisory |
| https://github.com/zbateson/mail-mime-parser/comm… | patch |
| https://github.com/zbateson/mail-mime-parser/comm… | patch |
| https://github.com/zbateson/mail-mime-parser/comm… | patch |
| https://github.com/zbateson/mail-mime-parser/comm… | patch |
| https://github.com/zbateson/mail-mime-parser/blob… | technical-description |
| https://www.vulncheck.com/advisories/zbateson-mai… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zbateson | mail-mime-parser |
Affected:
0.3.0 , < 3.0.9
(semver)
Affected: 4.0.0 , < 4.0.6 (semver) |
Date Public
2026-09-28 20:59
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121946",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:48:57.168802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:49:31.556Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-gmgm-r6fh-fq6g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/zbateson/mail-mime-parser",
"product": "mail-mime-parser",
"repo": "https://github.com/zbateson/mail-mime-parser",
"vendor": "zbateson",
"versions": [
{
"lessThan": "3.0.9",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
},
{
"lessThan": "4.0.6",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "AlpetGexha"
},
{
"lang": "en",
"type": "finder",
"value": "kemrec"
},
{
"lang": "en",
"type": "finder",
"value": "manus-pi"
}
],
"datePublic": "2026-09-28T20:59:37.000Z",
"descriptions": [
{
"lang": "en",
"value": "zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T12:31:23.166Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gmgm-r6fh-fq6g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-gmgm-r6fh-fq6g"
},
{
"tags": [
"patch"
],
"url": "https://github.com/zbateson/mail-mime-parser/commit/f385b2923023a9a7b69003468e363a4661f1c85a"
},
{
"tags": [
"patch"
],
"url": "https://github.com/zbateson/mail-mime-parser/commit/1fa840ef367958e991e6840b4e3ffd41aca9d147"
},
{
"tags": [
"patch"
],
"url": "https://github.com/zbateson/mail-mime-parser/commit/c31c62ccc3e66a7a7da0d79954ef83807f9daa20"
},
{
"tags": [
"patch"
],
"url": "https://github.com/zbateson/mail-mime-parser/commit/b032920875c6cb35bb2ddd7abfd7e98608d75bc0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zbateson/mail-mime-parser/blob/4.0.5/src/Message/Helper/MultipartHelper.php#L270-L273"
},
{
"name": "VulnCheck Advisory: zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zbateson-mail-mime-parser-before-3.0.9-and-4-x-before-4.0.6-crlf-header-injection-via-message-builders"
}
],
"title": "zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121946",
"datePublished": "2026-11-04T12:31:23.166Z",
"dateReserved": "2026-11-04T12:05:52.040Z",
"dateUpdated": "2026-11-04T18:49:31.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121432 (GCVE-0-2026-121432)
Vulnerability from cvelistv5 – Published: 2026-11-03 14:28 – Updated: 2026-11-03 18:29
VLAI
EPSS
VEX
Title
AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist
Summary
AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station's name.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:21 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/AzuraCast/AzuraCast/security/a… | vendor-advisory |
| https://www.vulncheck.com/advisories/azuracast-be… | third-party-advisory |
Impacted products
Date Public
2026-10-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121432",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:21:41.446844Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:29:09.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AzuraCast",
"vendor": "AzuraCast",
"versions": [
{
"lessThan": "0.24.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.24.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "skeletonsec"
}
],
"datePublic": "2026-10-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station\u0027s name."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T14:28:25.709Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cqgx-rqjr-5gf4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-cqgx-rqjr-5gf4"
},
{
"name": "VulnCheck Advisory: AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/azuracast-before-0.24.0-crlf-injection-via-mount-display-name-in-pls-playlist"
}
],
"title": "AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121432",
"datePublished": "2026-11-03T14:28:25.709Z",
"dateReserved": "2026-11-03T12:30:48.366Z",
"dateUpdated": "2026-11-03T18:29:09.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119560 (GCVE-0-2026-119560)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 15:54
VLAI
EPSS
VEX
Title
OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
Summary
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/blob/26.7.8/src/… | technical-description |
| https://github.com/opnsense/core/blob/26.7.8/src/… | technical-description |
| https://github.com/opnsense/core/security/advisor… | relatedvendor-advisory |
| https://abraxaslabs.tech/research/opnsense-ntp-gp… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-cor… | third-party-advisory |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:08.046274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:54:16.495Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThanOrEqual": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:08.977Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.8/src/etc/inc/plugins.inc.d/ntpd.inc#L285-L312"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.8/src/www/services_ntpd_gps.php#L49"
},
{
"name": "GitHub Security Advisory (GHSA-fq94-cxvc-9r7w)",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-ntp-gps-fudge"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-core-through-26.7.8-ntp-configuration-injection-via-gps-and-pps-fudge-fields"
}
],
"title": "OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119560",
"datePublished": "2026-10-30T11:31:08.977Z",
"dateReserved": "2026-10-30T10:53:29.701Z",
"dateUpdated": "2026-10-30T15:54:16.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119424 (GCVE-0-2026-119424)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-11-05 21:16
VLAI
EPSS
VEX
Title
OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
Summary
OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:15 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/commit/9f1eac0f9… | patch |
| https://github.com/opnsense/core/commit/3bbd714b4… | patch |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://abraxaslabs.tech/research/opnsense-wlan-w… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119424",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:15:55.382833Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:16:26.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://abraxaslabs.tech/research/opnsense-wlan-wpa-line"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThan": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ad Schellevis"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:54.395Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/9f1eac0f9bdf705766ab61f9d62b9d55757fd0da"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/3bbd714b4c4b60f164e2e908501f208d3eadf645"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/models/OPNsense/Interfaces/Wlan.xml#L185"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/etc/inc/interfaces.inc#L1901"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-wlan-wpa-line"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-before-26.7.8-wireless-wpa-configuration-line-injection-via-identity"
}
],
"title": "OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119424",
"datePublished": "2026-10-30T11:30:54.395Z",
"dateReserved": "2026-10-30T02:41:13.590Z",
"dateUpdated": "2026-11-05T21:16:26.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119417 (GCVE-0-2026-119417)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:55
VLAI
EPSS
VEX
Title
CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport
Summary
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:20 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
11 references
| URL | Tags |
|---|---|
| https://github.com/cakephp/cakephp/commit/2b9326c… | patch |
| https://github.com/cakephp/cakephp/commit/7735874… | patch |
| https://github.com/cakephp/cakephp/commit/3b99731… | patch |
| https://github.com/cakephp/cakephp/commit/e5936b2… | patch |
| https://github.com/cakephp/cakephp/pull/19695 | patchissue-tracking |
| https://github.com/cakephp/cakephp/blob/6f3dd9137… | technical-description |
| https://github.com/cakephp/cakephp/blob/6f3dd9137… | technical-description |
| https://github.com/cakephp/cakephp/security/advis… | relatedvendor-advisory |
| https://abraxaslabs.tech/research/cakephp-smtp-crlf | third-party-advisory |
| https://github.com/cakephp/cakephp | product |
| https://www.vulncheck.com/advisories/cakephp-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cakephp | cakephp |
Affected:
4.5.12 , ≤ 4.5.12
(semver)
Affected: 4.6.5 , ≤ 4.6.5 (semver) Affected: 5.1.8 , ≤ 5.1.10 (semver) Affected: 5.2.14 , ≤ 5.2.15 (semver) Affected: 5.3.7 , ≤ 5.3.7 (semver) Affected: 5.4.0 , ≤ 5.4.3 (semver) cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:* |
Date Public
2026-10-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119417",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:20:55.429443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:55:41.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cakephp/cakephp",
"product": "cakephp",
"repo": "https://github.com/cakephp/cakephp",
"vendor": "cakephp",
"versions": [
{
"lessThanOrEqual": "4.5.12",
"status": "affected",
"version": "4.5.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.6.5",
"status": "affected",
"version": "4.6.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.1.10",
"status": "affected",
"version": "5.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.15",
"status": "affected",
"version": "5.2.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.3.7",
"status": "affected",
"version": "5.3.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.3",
"status": "affected",
"version": "5.4.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.5.12",
"versionStartIncluding": "4.5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.6.5",
"versionStartIncluding": "4.6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.1.10",
"versionStartIncluding": "5.1.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.2.15",
"versionStartIncluding": "5.2.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.3.7",
"versionStartIncluding": "5.3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.4.3",
"versionStartIncluding": "5.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mark Story"
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:49.444Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/cakephp/cakephp/pull/19695"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57"
},
{
"name": "GitHub Security Advisory (GHSA-2qh5-382h-3jpc)",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/cakephp-smtp-crlf"
},
{
"tags": [
"product"
],
"url": "https://github.com/cakephp/cakephp"
},
{
"name": "VulnCheck Advisory: CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cakephp-through-5.4.3-email-header-injection-via-bare-cr-lf-in-smtptransport-and-mailtransport"
}
],
"title": "CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119417",
"datePublished": "2026-10-30T11:30:49.444Z",
"dateReserved": "2026-10-30T02:41:11.166Z",
"dateUpdated": "2026-10-30T15:55:41.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119415 (GCVE-0-2026-119415)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-11-04 02:19
VLAI
EPSS
VEX
Title
CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type
Summary
CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 02:18 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/cakephp/cakephp/commit/2e54c22… | patch |
| https://github.com/cakephp/cakephp/commit/27263ae… | patch |
| https://github.com/cakephp/cakephp/commit/c9a9114… | patch |
| https://github.com/cakephp/cakephp/commit/d66e016… | patch |
| https://github.com/cakephp/cakephp/pull/19715 | patchissue-tracking |
| https://github.com/cakephp/cakephp/blob/6f3dd9137… | technical-description |
| https://github.com/cakephp/cakephp/blob/6f3dd9137… | technical-description |
| https://abraxaslabs.tech/research/cakephp-attachm… | third-party-advisory |
| https://github.com/cakephp/cakephp | product |
| https://www.vulncheck.com/advisories/cakephp-thro… | third-party-advisory |
Impacted products
Date Public
2026-10-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119415",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T02:18:58.329348Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T02:19:32.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cakephp/cakephp",
"product": "cakephp",
"repo": "https://github.com/cakephp/cakephp",
"vendor": "cakephp",
"versions": [
{
"lessThanOrEqual": "5.4.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mark Story"
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:48.078Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/2e54c227eaa4c0e0d5edd74931710fd4f8bc38b5"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/27263ae750a3cd8464a5db076f48a731c8283df2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/c9a91149f04e2aee7faa30ed57d40f5b91d3f79e"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cakephp/cakephp/commit/d66e016d2fd9667dd605b56e25fbb3df5365406a"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/cakephp/cakephp/pull/19715"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Client/FormDataPart.php#L200"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Message.php#L1181"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/cakephp-attachment-crlf"
},
{
"tags": [
"product"
],
"url": "https://github.com/cakephp/cakephp"
},
{
"name": "VulnCheck Advisory: CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cakephp-through-5.4.3-mime-header-injection-via-formdatapart-content-type"
}
],
"title": "CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119415",
"datePublished": "2026-10-30T11:30:48.078Z",
"dateReserved": "2026-10-30T02:41:10.464Z",
"dateUpdated": "2026-11-04T02:19:32.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118372 (GCVE-0-2026-118372)
Vulnerability from cvelistv5 – Published: 2026-10-28 02:03 – Updated: 2026-10-28 16:11
VLAI
EPSS
VEX
Title
LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
Summary
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 14:35 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/openbsd/src/commit/6efdc4cce3f… | patch |
| https://github.com/openbsd/src/commit/3adb7688a5b… | patch |
| https://github.com/openbsd/src/blob/17a8e44328ee2… | technical-description |
| https://github.com/openbsd/src/blob/17a8e44328ee2… | technical-description |
| https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libr… | release-notes |
| https://github.com/libressl/portable | product |
| https://www.vulncheck.com/advisories/libressl-ocs… | third-party-advisory |
Impacted products
Date Public
2026-10-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118372",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T14:35:30.401668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:11:41.029Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/libressl/portable",
"product": "LibreSSL",
"repo": "https://github.com/libressl/portable",
"vendor": "OpenBSD",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbsd:libressl:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aziz Elbelaychy (Ostorlab)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Kenjiro Nakayama"
}
],
"datePublic": "2026-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate\u0027s AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:03:20.849Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/openbsd/src/commit/6efdc4cce3fac9fa7208a9452f84de34c5a68e9f"
},
{
"tags": [
"patch"
],
"url": "https://github.com/openbsd/src/commit/3adb7688a5bcfb675fa6d8b10e242022d620a23d"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/http.c#L344"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/ocspcheck.c#L154"
},
{
"name": "LibreSSL 4.4.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt"
},
{
"tags": [
"product"
],
"url": "https://github.com/libressl/portable"
},
{
"name": "VulnCheck Advisory: LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-crlf-injection-via-aia-ocsp-url-path"
}
],
"title": "LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118372",
"datePublished": "2026-10-28T02:03:20.849Z",
"dateReserved": "2026-10-28T01:19:20.199Z",
"dateUpdated": "2026-10-28T16:11:41.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118371 (GCVE-0-2026-118371)
Vulnerability from cvelistv5 – Published: 2026-10-28 02:03 – Updated: 2026-11-03 12:41
VLAI
EPSS
VEX
Title
LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
Summary
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 12:41 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/openbsd/src/commit/d3f7195f484… | patch |
| https://github.com/openbsd/src/blob/3903c41d301d6… | technical-description |
| https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libr… | release-notes |
| https://github.com/libressl/portable | product |
| https://www.vulncheck.com/advisories/libressl-thr… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T12:41:12.233917Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T12:41:48.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/libressl/portable",
"product": "LibreSSL",
"repo": "https://github.com/libressl/portable",
"vendor": "OpenBSD",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbsd:libressl:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aziz Elbelaychy (Ostorlab)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Theo Buehler"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate\u0027s Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:03:20.152Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/openbsd/src/commit/d3f7195f4849d8a699cea4a3a67677f4b3dc1591"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/openbsd/src/blob/3903c41d301d66facec69f7bf776b182cbc5ed62/lib/libcrypto/ocsp/ocsp_ht.c#L184"
},
{
"name": "LibreSSL 4.4.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt"
},
{
"tags": [
"product"
],
"url": "https://github.com/libressl/portable"
},
{
"name": "VulnCheck Advisory: LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libressl-through-4.4.0-crlf-injection-via-ocsp-sendreq-new-request-line"
}
],
"title": "LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118371",
"datePublished": "2026-10-28T02:03:20.152Z",
"dateReserved": "2026-10-28T01:19:19.814Z",
"dateUpdated": "2026-11-03T12:41:48.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116237 (GCVE-0-2026-116237)
Vulnerability from cvelistv5 – Published: 2026-10-26 09:15 – Updated: 2026-11-02 17:19
VLAI
EPSS
VEX
Title
Oray Pugongying X5 Pro Dnsmasq crlf injection
Summary
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:19 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426286 | vdb-entry |
| https://vuldb.com/vuln/426286/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116237 | third-party-advisory |
| https://vuldb.com/submit/1005085 | third-party-advisory |
| https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Oray | Pugongying X5 Pro |
Affected:
7.6.1
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116237",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:19:23.339248Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:19:33.808Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*"
],
"modules": [
"Dnsmasq"
],
"product": "Pugongying X5 Pro",
"vendor": "Oray",
"versions": [
{
"status": "affected",
"version": "7.6.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "FirmHarness (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CRLF Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T09:15:17.500Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426286 | Oray Pugongying X5 Pro Dnsmasq crlf injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/426286"
},
{
"name": "VDB-426286 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426286/cti"
},
{
"name": "CVE-2026-116237 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116237"
},
{
"name": "Submit #1005085 | Oray Pgyer X5 Pro Router 7.6.1 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1005085"
},
{
"tags": [
"exploit"
],
"url": "https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-DNS-Group-Newline-Injection-Runs-a-Root-Script-3ea797159f158048a73bf3ba23ccefdb"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T16:26:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "Oray Pugongying X5 Pro Dnsmasq crlf injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116237",
"datePublished": "2026-10-26T09:15:17.500Z",
"dateReserved": "2026-10-25T15:20:34.507Z",
"dateUpdated": "2026-11-02T17:19:33.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Avoid using CRLF as a special sequence.
Mitigation
Implementation
Appropriately filter or quote CRLF sequences in user-controlled input.
CAPEC-15: Command Delimiters
An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.