The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Primary

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Integrity
Modify Application Data

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Implementation
Avoid using CRLF as a special sequence.

Implementation
Appropriately filter or quote CRLF sequences in user-controlled input.

The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.

String author = request.getParameter(AUTHOR_PARAM);...Cookie cookie = new Cookie("author", author);cookie.setMaxAge(cookieExpiration);response.addCookie(cookie);

Assuming a string consisting of standard alpha-numeric characters, such as "Jane Smith", is submitted in the request the HTTP response including this cookie might take the following form:

HTTP/1.1 200 OK...Set-Cookie: author=Jane Smith...

However, because the value of the cookie is composed of unvalidated user input, the response will only maintain this form if the value submitted for AUTHOR_PARAM does not contain any CR and LF characters. If an attacker submits a malicious string, such as

Wiley Hacker\r\nHTTP/1.1 200 OK\r\n

then the HTTP response would be split into two responses of the following form:

HTTP/1.1 200 OK...Set-Cookie: author=Wiley HackerHTTP/1.1 200 OK...

The second response is completely controlled by the attacker and can be constructed with any header and body content desired. The ability to construct arbitrary HTTP responses permits a variety of resulting attacks, including:

cross-user defacement

web and browser cache poisoning

cross-site scripting

page hijacking

The following code is a workflow job written
using YAML. The code attempts to download pull request
artifacts, unzip from the artifact called pr.zip and
extract the value of the file NR into a variable
"pr_number" that will be used later in another job. It
attempts to create a github workflow environment
variable, writing to $GITHUB_ENV. The environment
variable value is retrieved from an external
resource.

name: Deploy Preview
jobs:

deploy:

runs-on: ubuntu-latest
steps:

- name: 'Download artifact'
uses: actions/github-script
with:

script: |

var artifacts = await github.actions.listWorkflowRunArtifacts({

owner: context.repo.owner,
repo: context.repo.repo,
run_id: ${{ github.event.workflow_run.id }},

});
var matchPrArtifact = artifacts.data.artifacts.filter((artifact) => {

return artifact.name == "pr"

})[0];
var downloadPr = await github.actions.downloadArtifact({

owner: context.repo.owner,
repo: context.repo.repo,
artifact_id: matchPrArtifact.id,
archive_format: 'zip',

});
var fs = require('fs');
fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(downloadPr.data));

- run: |

unzip pr.zip
echo "pr_number=$(cat NR)" >> $GITHUB_ENV

The code does not neutralize the value of the file NR, which is attacker controlled because
it originates from a pull request that produced pr.zip.
The attacker could escape the existing
pr_number and create a new variable using a "\n"
(CWE-93) followed by any environment variable to be
added such as:

\nNODE_OPTIONS="--experimental-modules --experiments-loader=data:text/javascript,console.log('injected code');//"

This would result in injecting and running
javascript code (CWE-94) on the workflow runner with
elevated privileges.

The code could be modified to validate that the NR
file only contains a numeric value, or the code could
retrieve the PR number from a more trusted source.

If user input data that eventually makes it to a log message isn't checked for CRLF characters, it may be possible for an attacker to forge entries in a log file.

logger.info("User's street address: " + request.getParameter("streetAddress"));

CVE-2002-1771
CRLF injection enables spam proxy (add mail headers) using email address or name.
https://www.cve.org/CVERecord?id=CVE-2002-1771

CVE-2002-1783
CRLF injection in API function arguments modify headers for outgoing requests.
https://www.cve.org/CVERecord?id=CVE-2002-1783

CVE-2004-1513
Spoofed entries in web server log file via carriage returns
https://www.cve.org/CVERecord?id=CVE-2004-1513

CVE-2006-4624
Chain: inject fake log entries with fake timestamps using CRLF injection
https://www.cve.org/CVERecord?id=CVE-2006-4624

CVE-2005-1951
Chain: Application accepts CRLF in an object ID, allowing HTTP response splitting.
https://www.cve.org/CVERecord?id=CVE-2005-1951

CVE-2004-1687
Chain: HTTP response splitting via CRLF in parameter related to URL.
https://www.cve.org/CVERecord?id=CVE-2004-1687

CRLF Injection

A2
Injection Flaws
CWE More Specific

24
HTTP Request Splitting

SFP24
Tainted input to command

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Sean Eidemiller
Cigital
2008-07-01
added/updated demonstrative examples

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities

CWE Content Team
MITRE
2009-03-10
updated References

CWE Content Team
MITRE
2009-05-27
updated Name

CWE Content Team
MITRE
2009-10-29
updated Other_Notes

CWE Content Team
MITRE
2009-12-28
updated Likelihood_of_Exploit

CWE Content Team
MITRE
2010-02-16
updated Related_Attack_Patterns, Taxonomy_Mappings

CWE Content Team
MITRE
2010-04-05
updated Related_Attack_Patterns

CWE Content Team
MITRE
2010-06-21
updated Description, Name

CWE Content Team
MITRE
2011-03-29
updated Description

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2015-12-07
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Causal_Nature, Likelihood_of_Exploit, Modes_of_Introduction, References, Relationships

CWE Content Team
MITRE
2019-06-20
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2022-04-28
updated Research_Gaps

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-11-19
4.16
2024-11-19
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-04-03
4.17
2025-04-03
updated Diagram, References

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Demonstrative_Examples, Relationships

CRLF Injection
Failure to Sanitize CRLF Sequences (aka 'CRLF Injection')
Failure to Sanitize CRLF Sequences ('CRLF Injection')