Loading story…
Researchers documented multiple ways HTTP header injection can occur when applications place untrusted input into response headers, showing that obsolete line folding and encoding edge cases can turn filtered data into new headers. One documented path abused Linear White Space (LWS) permitted under RFC 2616, where folded header lines could be interpreted inconsistently by browsers; Internet Explorer through IE11 could treat a folded continuation line as a separate header, enabling response splitting and browser-side script execution with impact similar to cross-site scripting. Later guidance in RFC 7230 deprecated this folding behavior and prohibited senders from emitting it in most cases.
A separate case in the Java web server Undertow (CVE-2018-1067) showed how CR/LF filtering could be bypassed even when direct newline characters were blocked. Undertow validated Java char values before converting them to bytes, allowing attackers to use multibyte characters such as U+560A that truncated to 0x0A during conversion and reintroduced a newline into the HTTP header stream. The flaw was fixed by checking for CR/LF after byte conversion, while broader mitigations across both cases include rejecting or sanitizing carriage return and line feed characters, avoiding validation before transformation, and relying on modern platform protections that enforce stricter header handling.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
On 2023-06-12, MBSD published an analysis of CVE-2018-1067 explaining how Undertow's pre-conversion CR/LF validation could be bypassed through Java char-to-byte truncation, enabling HTTP header injection.
On 2015-07-30, MBSD published research describing how folded HTTP headers and Internet Explorer parsing discrepancies could enable HTTP header injection, response splitting, and possible JavaScript execution when applications reflect untrusted input into headers.
PHP changed header handling in versions 5.4.38, 5.5.22, and 5.6.6 in February 2015 to reject headers containing LWS, closing off an RFC-compliant but dangerous path to header injection.
The author reported Internet Explorer's non-compliant handling of folded headers to Microsoft as a vulnerability in October 2014, but Microsoft responded that it would not fix the issue.
RFC 7230 was released in 2014 and replaced LWS folding with the obsolete term "obs-fold," stating that senders generally must not emit HTTP messages containing it.
ONsec Lab discussed a PHP multiple-header bypass using LWS in a 2012 blog post, highlighting that valid folded header syntax could be abused for header injection in some environments.
In 2012, PHP fixed a CR-related header injection bug, including PHP bug #60227, after it was found that PHP did not treat a lone carriage return as a dangerous separator even though multiple browsers did.
Undertow fixed CVE-2018-1067 by moving CR/LF checks to occur after char-to-byte conversion, preventing attackers from using multibyte characters that truncate to newline bytes to inject HTTP headers.
RFC 2616 defined Linear White Space (LWS) and allowed HTTP header values to be folded across multiple lines, a behavior later implicated in header injection issues when implementations parsed it inconsistently.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
mbsd.jp
Open sourcembsd.jp
Open sourcembsd.jp
Open sourcetools.ietf.org
Open sourcetools.ietf.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two vulnerabilities in the .NET libraries **RestSharp** and **Refit** that allowed **CRLF header injection** and **HTTP request splitting** through unsafe use of `HttpHeaders.TryAddWithoutValidation`. The issues, tracked as `CVE-2024-45302` and `CVE-2024-51501`, affected APIs that accepted attacker-controlled header values, including RestSharp methods such as `AddHeader`, `AddOrUpdateHeader`, and `AddDefaultHeader`, as well as Refit's `[Header]` and `[Authorize]` attributes. Proof-of-concept testing showed that injected `\r\n` sequences could append unintended headers or create a second HTTP/1.1 request, with Apache logs capturing unexpected requests to `/secret` endpoints. Microsoft's documentation for `TryAddWithoutValidation` states that the method validates header names but **does not validate header values**, and warns that untrusted input containing newline characters can cause application misbehavior and enable request smuggling-style attacks. The guidance recommends rejecting at least `\r`, `\n`, and `\0` before using the API. Both library maintainers accepted the reports and released fixes after disclosure, while the researcher said large-scale searches across GitHub and NuGet found many uses of the method but only these two libraries produced confirmed exploitable cases.
Aug 19, 2026
Red Hat disclosed two high-severity request smuggling vulnerabilities in **Undertow**, tracked as `CVE-2026-28367` and `CVE-2026-28368`, that let remote attackers exploit parsing differences between Undertow and upstream proxies. Both issues are classified as `CWE-444` and carry a CVSS v3.1 vector of `AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N`, indicating network-reachable attacks with high confidentiality and integrity impact. `CVE-2026-28367` allows attackers to use `\r\r\r` as a header block terminator to smuggle requests when Undertow sits behind certain proxy servers, with older versions of **Apache Traffic Server** and **Google Cloud Classic Application Load Balancer** specifically cited as exposed configurations. `CVE-2026-28368` stems from inconsistent header-name parsing between Undertow and upstream proxies, creating another path to bypass security controls and reach unauthorized resources through crafted requests.
Jun 29, 2026
PortSwigger Research disclosed an AI-assisted system called **HTTP Terminator** that autonomously generated, tested, and weaponized novel HTTP desynchronization and request smuggling techniques against authorized live targets. The pipeline, published on GitHub as a multi-stage research framework, reportedly produced tens of thousands of candidate vectors from RFC-derived fragments and led to multiple real-world findings, including new desync triggers, a **dual-matching `Content-Length`** desync pattern, a **dangling-byte** weaponization method to improve response queue poisoning, and evidence of a possible new class dubbed **response forking**. The work also uncovered and helped patch **Apache Traffic Server** zero-day **`CVE-2026-63078`**, while exposing exploitable issues involving **F5 Big-IP**, **BeyondTrust Secure Remote Access**, **Citrix NetScaler**, and some **Azure Application Gateway** plus **Akamai** deployments. A related PortSwigger paper detailed **CRLF-powered desync attacks** that turn HTTP header injection in misconfigured **Nginx**, **OpenResty**, and **Tengine** environments into request smuggling, response queue poisoning, browser-powered desync, and even self-propagating desync worms. The researchers said these browser-compatible attacks can enable **XSS**, account takeover, token and cookie theft, and cross-user compromise across sectors including CDN, telecom, payments, retail, streaming, and social platforms. Recommended mitigations included avoiding unsafe use of **`$uri`** or **`$document_uri`** in `proxy_pass` or `return` directives, reviewing upstream proxy configurations, and enabling **HTTP/2 upstream** where possible.
Aug 13, 2026