CRLF / header injection
%0d%0a in a value that is copied into a response header. HTTP/1.1 only for classic splitting; HTTP/2 is a different (and rarer) story.
Tags: crlf, cache, xss
Typical severity: P3-P4
What it becomes
Set-Cookie, Location, or a second response on a shared connection. Often a cache or XSS gadget, not a standalone RCE.
Where to look
redirect paramsfilename in Content-Dispositioncustom headers copied from input
Chains
- Session fixation — Inject Set-Cookie.
- XSS — Inject a second response body with HTML, or a Location: javascript:.
- Cache poison — Split so a CDN caches the injected body under a popular key.
Notes
- Most modern frameworks reject CR/LF in header values. You still find it in homemade Go/Node servers and in some email subjects (SMTP injection).