Loading story…
PHP updated its header() handling to reject malformed HTTP headers containing carriage return (\r), line feed (\n), or NUL characters, closing Bug #60227 in the header() function. The change hardens SAPI header validation so any embedded CR or LF is refused outright, aligning behavior with RFC 7230, which deprecated legacy header folding and treats such input as invalid.
The patch modified validation logic and accompanying tests to ensure folded or multi-line headers now trigger warnings instead of being accepted. Expected output was also changed so only the default Content-type header remains when invalid input is supplied, reducing the risk of HTTP header injection and response splitting through crafted multi-line header values.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
A php-src commit updated SAPI header validation to reject any carriage return or line feed characters in header lines, hardening PHP against header injection and response splitting via malformed multi-line headers. The change also kept NUL-byte rejection and updated related tests to expect warnings instead of accepting folded headers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple ways HTTP header injection can occur when applications place untrusted input into response headers, showing that obsolete line folding and encoding edge cases can turn filtered data into new headers. One documented path abused **Linear White Space (LWS)** permitted under `RFC 2616`, where folded header lines could be interpreted inconsistently by browsers; Internet Explorer through IE11 could treat a folded continuation line as a separate header, enabling response splitting and browser-side script execution with impact similar to cross-site scripting. Later guidance in `RFC 7230` deprecated this folding behavior and prohibited senders from emitting it in most cases. A separate case in the Java web server **Undertow** (`CVE-2018-1067`) showed how CR/LF filtering could be bypassed even when direct newline characters were blocked. Undertow validated Java `char` values before converting them to bytes, allowing attackers to use multibyte characters such as `U+560A` that truncated to `0x0A` during conversion and reintroduced a newline into the HTTP header stream. The flaw was fixed by checking for CR/LF after byte conversion, while broader mitigations across both cases include rejecting or sanitizing carriage return and line feed characters, avoiding validation before transformation, and relying on modern platform protections that enforce stricter header handling.
Aug 15, 2026
Researchers disclosed two vulnerabilities in the .NET libraries **RestSharp** and **Refit** that allowed **CRLF header injection** and **HTTP request splitting** through unsafe use of `HttpHeaders.TryAddWithoutValidation`. The issues, tracked as `CVE-2024-45302` and `CVE-2024-51501`, affected APIs that accepted attacker-controlled header values, including RestSharp methods such as `AddHeader`, `AddOrUpdateHeader`, and `AddDefaultHeader`, as well as Refit's `[Header]` and `[Authorize]` attributes. Proof-of-concept testing showed that injected `\r\n` sequences could append unintended headers or create a second HTTP/1.1 request, with Apache logs capturing unexpected requests to `/secret` endpoints. Microsoft's documentation for `TryAddWithoutValidation` states that the method validates header names but **does not validate header values**, and warns that untrusted input containing newline characters can cause application misbehavior and enable request smuggling-style attacks. The guidance recommends rejecting at least `\r`, `\n`, and `\0` before using the API. Both library maintainers accepted the reports and released fixes after disclosure, while the researcher said large-scale searches across GitHub and NuGet found many uses of the method but only these two libraries produced confirmed exploitable cases.
Aug 19, 2026
PHP has patched two memory-safety vulnerabilities in its `ext/standard` image-handling code that can be triggered by specially crafted JPEG input. One issue, tracked as **CVE-2025-14177**, affects `getimagesize` and can disclose uninitialized heap memory when JPEG APP segments are read across multiple chunks, potentially exposing server-side data through returned metadata such as `APP1`. A second flaw in `iptcembed` can cause a heap buffer overflow and denial of service because the function sizes its output buffer from a single `fstat()` result and then continues copying data until EOF, creating risk when processing FIFOs, pipes, sockets, or files that grow after the initial size check. The bugs were discovered by Positive Technologies researcher Nikita Sveshnikov, who published proof-of-concept demonstrations showing both filter-based and direct exploitation paths for `getimagesize`, as well as a FIFO-based overflow scenario for `iptcembed`. PHP addressed the flaws by correcting chunk-buffer pointer handling in `php_read_stream_all_chunks` and adding boundary checks and safer error handling for `iptcembed`; fixes were released in **PHP 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1**. The most exposed deployments include public upload endpoints, CMS thumbnailing workflows, webmail platforms, and image CDNs that inspect user-supplied images on the server side.
Jun 29, 2026