On this page

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

Weakness Summary

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

  • Canonical source: MITRE CWE-93
  • Published Atomicorp CVE observations: 10
  • Distinct affected products in those observations: 10
  • Active Atomicorp rules associated with this weakness: 27

Atomicorp Research Context

Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.

The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.

A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.

Selected Published CVE Observations

CVEVulnerabilityProductAtomicorp findingObserved rules
CVE-2026-39394CI4MS has an .env CRLF Injection via Unvalidated host Parameter in Install Controllerci4msProtected by Atomicorp rules340007 , 344360 , 347009
CVE-2026-84372Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connectionspredisProtected by Atomicorp rules340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390722 , 393655
CVE-2022-0666Microweber < 1.2.11 - CRLF InjectionmicroweberProtected by Atomicorp rules330708 , 390722
CVE-2025-61884Oracle E-Business Suite - Server-Side Request ForgeryconfiguratorProtected by Atomicorp rules337109 , 337110 , 340162 , 340163 , 340165 , 341256 , 342259 , 344360 , 347009 , 390722 , 398021 , 398022
CVE-2026-111221Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf InjectionpfsenseProtected by Atomicorp rules340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-22777ComfyUI-Manager CRLF Injection in Configuration Handler (CVE-2026-22777)comfyui-managerProtected by Atomicorp rules390722
CVE-2016-4975Apache mod_userdir CRLF injectionhttp serverProtected by Atomicorp rules330708 , 390714
CVE-2017-5868OpenVPN Access Server 2.1.4 - CRLF Injectionopenvpn access serverProtected by Atomicorp rules330708 , 390714
CVE-2026-42578Netty: HTTP Header Injection via HttpProxyHandler Disabled ValidationnettyProtected by Atomicorp rules390719
CVE-2026-94216ST Engineering iDirect Evolution/Velocity WebServer Evolution HTTP Header webserver authorize redirectiDXProtected by Atomicorp rules340165 , 344365

Associated Atomicorp WAF Rules

RuleStatusBehavior
330708Activedisruptive (deny)
337109Activedisruptive (deny)
337110Activedisruptive (deny)
340007Activedisruptive (deny)
340014Activedisruptive (deny)
340023Activedisruptive (deny)
340029Activedisruptive (deny)
340162Activedisruptive (deny)
340163Activedisruptive (deny)
340165Activedisruptive (deny)
340193Activedisruptive (deny)
341256Activedisruptive (deny)
342259Activedisruptive (deny)
344360Activedisruptive (deny)
344361Activedisruptive (deny)
344363Activedisruptive (deny)
344364Activedisruptive (deny)
344365Activedisruptive (deny)
344366Activedisruptive (deny)
344370Activedisruptive (deny)
347009Activedisruptive (deny)
390714Activedisruptive (deny)
390719Activedisruptive (deny)
390722Activedisruptive (deny)
393655Activedisruptive (deny)
398021Activedisruptive (deny)
398022Activedisruptive (deny)

MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:

CAPEC-15 , CAPEC-81