HTTP response header injection
Summary: HTTP response header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way, letting an attacker who can inject newline characters add new HTTP headers or, by injecting an empty line, break out of the headers and write arbitrary content into the response body. PortSwigger notes that any attack deliverable via cross-site scripting can usually be delivered this way, and that the flaw can sometimes be used to poison a proxy server's cache so a crafted request produces a split response that compromises other users who later request that URL.
Key Takeaway: A single unvalidated newline in a response header can turn into a cached, stored attack served to every user routed through a shared proxy - and PortSwigger's minimum bar is rejecting any input containing characters with ASCII codes below 0x20.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026