CWE-93 对CRLF序列的转义处理不恰当(CRLF注入) 类弱点 178 条 CVE 漏洞汇总，含 AI 中文分析。
CRLF注入是一种输入验证缺陷，指程序未正确过滤用户输入中的回车换行符。攻击者利用此漏洞注入恶意CRLF序列，篡改HTTP响应头或伪造日志，进而实施会话劫持、跨站脚本或缓存投毒。开发者应严格对用户输入进行白名单验证，确保仅包含合法字符，并在使用输入前自动转义或移除CRLF序列，以阻断注入路径。
String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...name: Deploy Preview jobs: deploy: runs-on: ubuntu-latest steps: - name: 'Download artifact' uses: actions/github-script with: script: | var artifacts = await github.actions.listWorkflowRunArtifacts({ owner: context.repo.owner, repo: context.repo.repo, run_id: ${{ github.event.workflow_run.id }}, }); var matchPrArtifact = artifacts.data.artifacts.filter((artifact) => { return artifact.name == "pr" })[0]; var downloadPr = await github.actions.downloadArtifact({ owner: context.repo.owner, repo: context.repo.repo, artifact_id: matchPrArtifact.id, archive_format: 'zip', }); var fs = require('fs');\nNODE_OPTIONS="--experimental-modules --experiments-loader=data:text/javascript,console.log('injected code');//"| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-71573 | joomla 输入验证错误漏洞 — Joomla! CMS | 6.9 | Medium | 2026-08-18 |
| CVE-2026-71572 | Joomla! CMS 输入验证错误漏洞 — Joomla! CMS | 4.8 | Medium | 2026-08-18 |
| CVE-2026-45125 | MyBB 输入验证错误漏洞 — mybb | 5.3 | Medium | 2026-08-18 |
| CVE-2026-53788 | RsyncProject Rsync 输入验证错误漏洞 — rsync | 6.5 | Medium | 2026-08-13 |
| CVE-2026-16455 | Teltonika Networks RUTOS 输入验证错误漏洞 — RUTOS | 6.9 | Medium | 2026-08-13 |
| CVE-2026-72590 | Suresh Alse Crontab UI 输入验证错误漏洞 — crontab-ui | 9.8 | Critical | 2026-08-10 |
| CVE-2026-61477 | libvirt 输入验证错误漏洞 — Red Hat Enterprise Linux 10 | 2.3 | Low | 2026-08-07 |
| CVE-2026-0673 | WordPress Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons 输入验证错误漏洞 — Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | 5.3 | Medium | 2026-08-06 |
| CVE-2026-71311 | Rclone 输入验证错误漏洞 — rclone | 6.4 | Medium | 2026-08-05 |
| CVE-2026-70615 | boringproxy 输入验证错误漏洞 — boringproxy | 9.9 | Critical | 2026-08-05 |
| CVE-2026-65636 | UFirst Group ymlr 输入验证错误漏洞 — ymlr | 2.1 | Low | 2026-07-31 |
| CVE-2026-44092 | PHOENIX CONTACT CHARX SEC-3150 输入验证错误漏洞 — CHARX SEC-3150 | 9.1 | Critical | 2026-07-30 |
| CVE-2026-15157 | undici 输入验证错误漏洞 — undici | 4.2 | Medium | 2026-07-29 |
| CVE-2026-12357 | Heimdall Data Database Proxy 输入验证错误漏洞 — Database Proxy | - | - | 2026-07-29 |
| CVE-2026-59919 | Netty 输入验证错误漏洞 — netty | 5.5 | Medium | 2026-07-29 |
| CVE-2026-59920 | Netty 输入验证错误漏洞 — netty | 6.5 | Medium | 2026-07-29 |
| CVE-2026-59921 | Netty 输入验证错误漏洞 — netty | 5.7 | Medium | 2026-07-28 |
| CVE-2026-57511 | superplanehq superplane 输入验证错误漏洞 — superplane | 5.4 | Medium | 2026-07-28 |
| CVE-2026-16313 | doug-gilbert sg3_utils 输入验证错误漏洞 — Red Hat Enterprise Linux 10 | 7.6 | High | 2026-07-28 |
| CVE-2026-45070 | Symfony 输入验证错误漏洞 — symfony | - | - | 2026-07-14 |
| CVE-2026-45067 | Symfony 输入验证错误漏洞 — symfony | - | - | 2026-07-14 |
| CVE-2026-15429 | TP-Link Systems Inc Archer VX1800v v1 输入验证错误漏洞 — Archer VX1800v v1 | - | - | 2026-07-14 |
| CVE-2026-50188 | getkirby kirby 输入验证错误漏洞 — kirby | - | - | 2026-07-09 |
| CVE-2026-12127 | Syed Balkhi WPForms 输入验证错误漏洞 — WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | 5.3 | Medium | 2026-07-01 |
| CVE-2026-55766 | guzzle psr7 输入验证错误漏洞 — psr7 | 4.8 | Medium | 2026-06-23 |
| CVE-2026-55603 | Steven Chim http-proxy-middleware 输入验证错误漏洞 — http-proxy-middleware | 7.5 | High | 2026-06-22 |
| CVE-2026-50269 | aio-libs aiohttp 输入验证错误漏洞 — aiohttp | - | - | 2026-06-22 |
| CVE-2026-11373 | JASEI Net::Statsite::Client 输入验证错误漏洞 — Net::Statsite::Client | - | - | 2026-06-22 |
| CVE-2026-9679 | Node.js undici 输入验证错误漏洞 — undici | 5.9 | Medium | 2026-06-17 |
| CVE-2026-12143 | FormData Form-Data 输入验证错误漏洞 — form-data | 7.5 | High | 2026-06-12 |
CWE-93（对CRLF序列的转义处理不恰当(CRLF注入)） 是常见的弱点类别，本平台收录该类弱点关联的 178 条 CVE 漏洞。