CVE-2026-12357— Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability
Possible ATT&CK Techniques 2AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Heimdall Data | Database Proxy | 25.03.01.21 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12357
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specific flaw exists within the generateFileContent function. The issue results from the lack of proper neutralization of CRLF sequences. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29251.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对CRLF序列的转义处理不恰当(CRLF注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Heimdall Data | Database Proxy | 25.03.01.21 | - |
II. Public POCs for CVE-2026-12357
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12357
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12357 (1)
- 🔗 ZDI-26-447 - TrendAI™ Zero Day Initiative™ (ZDI)x_research-advisory
IV. Related Vulnerabilities
Same weakness: CWE-93
- CVE-2026-44092
Missing input validation / stripping of CRLF characters in S - CVE-2026-15157
undici vulnerable to CRLF Injection via blob-like body 'type - CVE-2026-59919
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Addres - CVE-2026-59920
Netty: STOMP CONNECT Frame Header Injection - CVE-2026-59921
Netty: CRLF Injection via Multipart Filename in Netty HttpPo
V. Comments for CVE-2026-12357
No comments yet