Cyber Resilience

CWE · MITRE source

CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')

Abstraction: Base · CVEs in our corpus: 211

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Last updated: 21 August 2026 10:11 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 2 mapping(s) from 1 framework(s): CAPEC 2 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PR.PS-06
  • SI-10 Information Input Validation
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V4.2.4

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2025-61884 KEV 8.57.50.97792025-10-12
CVE-2021-39172 8.18.80.29172021-08-27
CVE-2022-0666 7.87.50.44262022-02-18
CVE-2026-725907.69.80.01282026-08-10
CVE-2024-20337 7.48.20.29912024-03-06
CVE-2026-42257 7.39.80.00432026-05-09
CVE-2026-11362 7.39.80.00452026-06-05
CVE-2019-10678 7.07.50.17272019-03-31
CVE-2018-19585 6.97.50.14512019-05-17
CVE-2026-39983 6.98.60.02192026-04-09
CVE-2026-45372 6.99.90.00292026-05-29
CVE-2026-113736.99.10.00572026-06-22
CVE-2024-32986 6.89.60.00682024-05-03
CVE-2026-399586.89.10.00362026-04-09
CVE-2026-9270 6.89.10.00332026-06-05
CVE-2026-50638 6.89.10.00342026-06-10
CVE-2026-440926.89.10.00382026-07-30
CVE-2026-706156.89.90.00222026-08-05
CVE-2026-355176.78.80.00862026-04-07
CVE-2026-355186.78.80.00692026-04-07
CVE-2026-355206.78.80.00702026-04-07
CVE-2026-355216.78.80.00692026-04-07
CVE-2026-39849 6.78.80.00962026-05-05
CVE-2026-15429 6.78.80.00842026-07-14
CVE-2016-3115 6.66.40.37022016-03-22