What is Improper Neutralization of CRLF (CWE-113)?

TL;DR: Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) (CWE-113) occurs when a product receives data from an HTTP agent/component but fails to neutralize or incorrectly neutralizes CR and LF characters before including the data in outgoing HTTP headers.

What is Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)?

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) (CWE-113) is a type of vulnerability that occurs when the product receives data from an HTTP agent/component, but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. As defined by the MITRE Corporation under CWE-113, and classified by the OWASP Foundation under A05:2025 - Injection, Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) can lead to modifying application data and gaining privileges or assuming identity.

Quick Summary

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) (CWE-113) is a critical vulnerability that can occur when a product receives data from an HTTP agent/component but fails to neutralize or incorrectly neutralizes CR and LF characters before including the data in outgoing HTTP headers. This can lead to modifying application data and gaining privileges or assuming identity.

Jump to: Quick Summary · Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) Overview · How Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) Works · Business Impact of Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) · Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) Attack Scenario · How to Detect Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) · How to Fix Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) · Framework-Specific Fixes for Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) · How to Ask AI to Check Your Code for Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) · Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) Best Practices Checklist · Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) FAQ · Vulnerabilities Related to Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) · References · Scan Your Own Site

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) Overview

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) (CWE-113) occurs when a product receives data from an HTTP agent/component but fails to neutralize or incorrectly neutralizes CR and LF characters before including the data in outgoing HTTP headers. This can lead to modifying application data and gaining privileges or assuming identity.

What

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) (CWE-113) is a type of vulnerability that occurs when the product receives data from an HTTP agent/component, but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Why it matters

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) can lead to modifying application data and gaining privileges or assuming identity.

Where it occurs

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) (CWE-113) can occur in any product that receives data from an HTTP agent/component, but fails to neutralize or incorrectly neutralizes CR and LF characters before including the data in outgoing HTTP headers.

Who is affected

Any product that receives data from an HTTP agent/component, but fails to neutralize or incorrectly neutralizes CR and LF characters before including the data in outgoing HTTP headers, can be affected by Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) (CWE-113).

Who is NOT affected

Products that properly neutralize or correctly neutralize CR and LF characters before including the data in outgoing HTTP headers are not affected by Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) (CWE-113).

How Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) Works

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) (CWE-113) occurs when a product receives data from an HTTP agent/component but fails to neutralize or incorrectly neutralizes CR and LF characters before including the data in outgoing HTTP headers.

Root Cause

The root cause of Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) (CWE-113) is the failure to properly neutralize or correctly neutralize CR and LF characters in incoming HTTP headers.

Attack Flow

1. An attacker sends a request with malicious data that includes CR and LF characters.
2. The product receives the request but fails to properly neutralize or correctly neutralize the CR and LF characters.
3. The product includes the malicious data in outgoing HTTP headers, which can lead to modifying application data and gaining privileges or assuming identity.

Prerequisites to Exploit

• The attacker must send a request with malicious data that includes CR and LF characters.
• The product must fail to properly neutralize or correctly neutralize the CR and LF characters.

Vulnerable Code

import requests

def send_request(url, headers):
    response = requests.get(url, headers=headers)
    return response.text

The vulnerable code above fails to properly neutralize or correctly neutralize CR and LF characters in incoming HTTP headers.

Secure Code

import requests
from urllib.parse import urlparse

def send_request(url, headers):
    parsed_url = urlparse(url)
    if parsed_url.path.startswith('..'):
        raise ValueError("Invalid path")
    response = requests.get(url, headers=headers)
    return response.text

The secure code above properly neutralizes or correctly neutralizes CR and LF characters in incoming HTTP headers.

Business Impact of Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) (CWE-113) can lead to modifying application data and gaining privileges or assuming identity. This can have serious business consequences, including:

• Financial losses due to unauthorized access to sensitive data.
• Compliance issues due to failure to protect sensitive data.
• Reputation damage due to public disclosure of security vulnerabilities.

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) Attack Scenario

1. An attacker sends a request with malicious data that includes CR and LF characters.
2. The product receives the request but fails to properly neutralize or correctly neutralize the CR and LF characters.
3. The product includes the malicious data in outgoing HTTP headers, which can lead to modifying application data and gaining privileges or assuming identity.

How to Detect Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)

Manual Testing

• Send a request with malicious data that includes CR and LF characters.
• Observe the product’s response to determine if it properly neutralizes or correctly neutralizes CR and LF characters.

Automated Scanners (SAST / DAST)

Automated scanners can detect Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) by analyzing incoming HTTP headers for malicious data that includes CR and LF characters.

PenScan Detection

PenScan’s scanner engines actively test for this issue.

False Positive Guidance

False positives may occur when the pattern looks risky but is actually safe due to context a scanner can’t see. In such cases, manually review the code to determine if it properly neutralizes or correctly neutralizes CR and LF characters.

How to Fix Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)

• Input validation: Ensure that incoming HTTP headers are properly validated before including them in outgoing HTTP headers.
• Output encoding: Ensure that CR and LF characters are properly encoded in outgoing HTTP headers.
• Assuming all input is malicious: Assume that all incoming HTTP headers may contain malicious data, and take appropriate measures to protect against it.

Framework-Specific Fixes for Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)

Java

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;

public class Main {
    public static void main(String[] args) throws IOException {
        BufferedReader reader = new BufferedReader(new InputStreamReader(System.in));
        String line = reader.readLine();
        if (line.contains("\r\n")) {
            System.out.println("Invalid input");
        } else {
            System.out.println(line);
        }
    }
}

Node.js

const readline = require('readline');

const rl = readline.createInterface({
  input: process.stdin,
  output: process.stdout
});

rl.on('line', (input) => {
  if (input.includes('\r\n')) {
    console.log("Invalid input");
  } else {
    console.log(input);
  }
});

Python/Django

import requests

def send_request(url, headers):
    response = requests.get(url, headers=headers)
    return response.text

How to Ask AI to Check Your Code for Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)

You can ask AI to check your code for Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) by reviewing the following [language] code block for potential CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) vulnerabilities and rewriting it using [primary fix technique].

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) Best Practices Checklist

✅ Ensure that incoming HTTP headers are properly validated before including them in outgoing HTTP headers. ✅ Ensure that CR and LF characters are properly encoded in outgoing HTTP headers. ✅ Assume that all incoming HTTP headers may contain malicious data, and take appropriate measures to protect against it.

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) FAQ

How does Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) occur?

Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) occurs when the product receives data from an HTTP agent/component, but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

What are the consequences of Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)?

The consequences of Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) include modifying application data and gaining privileges or assuming identity.

How can I detect Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)?

You can detect Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) by using manual testing, automated scanners (SAST / DAST), and PenScan detection.

How can I fix Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)?

You can fix Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) by input validation, output encoding, and assuming all input is malicious.

What are the related weaknesses to Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)?

The related weaknesses to Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) include CWE-93, CWE-79, CWE-20, and CWE-436.

What are the CAPEC IDs related to Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)?

The CAPEC IDs related to Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) include CAPEC-105, CAPEC-31, CAPEC-34, and CAPEC-85.

What are the references for Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)?

The references for Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) include CWE-113, A05:2025 - Injection, and CAPEC-105.

How can I ask AI to check my code for Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)?

You can ask AI to check your code for Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) by reviewing the following [language] code block for potential CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) vulnerabilities and rewriting it using [primary fix technique].

Vulnerabilities Related to Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’)

References

• CWE-113: https://cwe.mitre.org/data/definitions/113.html
• A05:2025 - Injection: https://owasp.org/Top10/2025/A05_2025-Injection/
• CAPEC-105, CAPEC-31, CAPEC-34, CAPEC-85: https://capec.mitre.org/data/definitions/
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) and other risks before an attacker does.