CRLF injection

What it means

CRLF stands for carriage return and line feed, the two characters that end a line in many text formats, including HTTP headers, email and log files. CRLF injection is slipping those characters into input so that the receiving system treats them as the end of one line and the start of another.

The attacker does not need to run code. They only need an application that copies their text into a line-based format without removing the line breaks. It is a flaw in how text is assembled, not in how a server is configured, so patching the server rarely fixes it. The same few characters work across many systems, which is why the technique keeps returning.

Why it matters

What follows depends on where the text lands. In an HTTP response it can add headers or split the response. In a log it can forge entries. In an email it can add recipients. Each is a way for an outsider to write lines that your system believes it wrote itself. MITRE lists the weakness as CWE-93.

The business effects are indirect but real: planted cookies, poisoned caches, spam sent from your mail server, and log records that mislead an investigation. These are often found late because nothing crashes. Spam sent through your mail server can also get your domain blocked, which stops legitimate email from reaching customers.

How it shows up

You meet it in redirect and cookie handling, file name headers, contact forms that build emails, and logging that records raw input. Line breaks may arrive encoded, as %0d and %0a in a URL, which a filter that checks only for literal characters can miss.

Decode input first, then reject or remove carriage return and line feed in any value that goes into a header, subject line or log line. Use library functions that handle structure for you, rather than joining strings. Test by sending encoded line breaks in each field and checking the output. See header injection and log injection.