Monthly
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 through 3.2.x when pipeline() is used over aggregate cluster or replication connections. Because AbstractAggregateConnection::write() re-splits an already-serialized RESP buffer on CRLF instead of respecting RESP length prefixes, attacker-controlled keys or values containing carriage-return/line-feed bytes are re-parsed as additional Redis commands, enabling shard-wide cache deletion, targeted data reads/writes, or node disruption on clusters and denial-of-service on replication setups. Fixed in 3.3.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
SMTP command injection in Nodemailer before 8.0.4 lets attackers smuggle arbitrary SMTP verbs (notably RCPT TO) into outgoing mail by planting CRLF characters in the envelope.size value, silently adding attacker-controlled recipients or otherwise manipulating the MAIL FROM dialogue. Only applications that pass a custom envelope object and expose its size property to untrusted input are affected, since Nodemailer's default auto-constructed envelope never sets size. A working proof-of-concept is published in the GHSA advisory; there is no public exploit identified beyond that PoC and no evidence of active exploitation.
SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the transport `name` configuration option to inject arbitrary SMTP commands by embedding CRLF sequences in the value. The EHLO, HELO, and LHLO commands are constructed via direct string concatenation in lib/smtp-connection/index.js without sanitization, enabling unauthorized email sending, spoofing, and phishing through the configured SMTP relay. A proof-of-concept is publicly available in the GHSA advisory; no KEV listing is present, indicating exploitation has not been confirmed at mass scale at time of analysis.
CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comment parameters to inject arbitrary RFC822 message headers into outbound emails. Versions up to and including 8.0.8 of the npm package are affected; the fix is available in 8.0.9. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, making this a medium-severity issue with practical impact confined to applications that expose the list comment API surface to untrusted input.
Dsync stream protocol command injection in OX Dovecot Pro and OX Dovecot CE allows an authenticated mail user to store crafted content that is later interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol during a migration or replication. Successful injection enables modification of mailbox state on the destination server, including internal mailbox attributes that a user should not be able to manipulate directly. No public exploits are known and no CISA KEV listing exists; exploitation depends on an administrator-initiated dsync stream operation against a mailbox containing attacker-controlled content.
HTTP response splitting in cpp-httplib 0.49.0 allows an attacker who can influence chunked response trailer values to inject arbitrary headers into the HTTP response stream, potentially forging responses seen by downstream clients. The trailer-writing path in write_content_chunked() is the sole code path in the library that omits the CRLF validation applied by set_header() and every other header-writing function, meaning attacker-controlled CR/LF sequences pass directly to the socket. No public exploit code and no CISA KEV listing have been identified; the fix is confirmed in version 0.50.0 via upstream security advisory GHSA-2r2h-jc8w-w66c.
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across Spring Framework 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19 and 7.0.0-7.0.8, where unneutralized CRLF sequences (CWE-93) let an attacker inject into or corrupt the event stream. Reported by VMware/Spring and tagged as Information Disclosure, the flaw can break stream framing and potentially leak or splice data across SSE responses. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), but the vendor-assigned CVSS of 9.8 (all-High impact) sits in tension with the information-disclosure framing and warrants scrutiny.
Cross-response information disclosure and stream corruption affects Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8 (both MVC and WebFlux) when applications serve Server-Sent Events (SSE) together with view fragments, letting remote attackers corrupt the event stream and potentially bleed data across responses. No public exploit is identified at time of analysis and CISA has not listed the flaw in KEV; EPSS is low at 0.15% (5th percentile). The vendor-assigned 9.8 rating sits uneasily against the CWE-93 root cause, the 'Information Disclosure' tagging, and the SSVC 'exploitation: none' status, suggesting the paper severity outruns observed real-world risk.
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream collectors such as rsyslog, Splunk, and Elastic Stack. The escapeStructuredDataValue() function omits C0 control character escaping, so a literal newline embedded in a log property value terminates the current RFC 6587 TCP syslog frame and begins a new one; if the attacker-supplied bytes constitute a valid RFC 5424 header, the downstream collector accepts them as a separate, authentic-looking record. A second injection path exists through unvalidated SD-NAME keys, which can prematurely close structured-data elements. Both paths require the non-default SyslogSinkOptions.includeStructuredData: true setting. Publicly available proof-of-concept code exists; no CISA KEV listing at time of analysis.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 through 3.2.x when pipeline() is used over aggregate cluster or replication connections. Because AbstractAggregateConnection::write() re-splits an already-serialized RESP buffer on CRLF instead of respecting RESP length prefixes, attacker-controlled keys or values containing carriage-return/line-feed bytes are re-parsed as additional Redis commands, enabling shard-wide cache deletion, targeted data reads/writes, or node disruption on clusters and denial-of-service on replication setups. Fixed in 3.3.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
SMTP command injection in Nodemailer before 8.0.4 lets attackers smuggle arbitrary SMTP verbs (notably RCPT TO) into outgoing mail by planting CRLF characters in the envelope.size value, silently adding attacker-controlled recipients or otherwise manipulating the MAIL FROM dialogue. Only applications that pass a custom envelope object and expose its size property to untrusted input are affected, since Nodemailer's default auto-constructed envelope never sets size. A working proof-of-concept is published in the GHSA advisory; there is no public exploit identified beyond that PoC and no evidence of active exploitation.
SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the transport `name` configuration option to inject arbitrary SMTP commands by embedding CRLF sequences in the value. The EHLO, HELO, and LHLO commands are constructed via direct string concatenation in lib/smtp-connection/index.js without sanitization, enabling unauthorized email sending, spoofing, and phishing through the configured SMTP relay. A proof-of-concept is publicly available in the GHSA advisory; no KEV listing is present, indicating exploitation has not been confirmed at mass scale at time of analysis.
CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comment parameters to inject arbitrary RFC822 message headers into outbound emails. Versions up to and including 8.0.8 of the npm package are affected; the fix is available in 8.0.9. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, making this a medium-severity issue with practical impact confined to applications that expose the list comment API surface to untrusted input.
Dsync stream protocol command injection in OX Dovecot Pro and OX Dovecot CE allows an authenticated mail user to store crafted content that is later interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol during a migration or replication. Successful injection enables modification of mailbox state on the destination server, including internal mailbox attributes that a user should not be able to manipulate directly. No public exploits are known and no CISA KEV listing exists; exploitation depends on an administrator-initiated dsync stream operation against a mailbox containing attacker-controlled content.
HTTP response splitting in cpp-httplib 0.49.0 allows an attacker who can influence chunked response trailer values to inject arbitrary headers into the HTTP response stream, potentially forging responses seen by downstream clients. The trailer-writing path in write_content_chunked() is the sole code path in the library that omits the CRLF validation applied by set_header() and every other header-writing function, meaning attacker-controlled CR/LF sequences pass directly to the socket. No public exploit code and no CISA KEV listing have been identified; the fix is confirmed in version 0.50.0 via upstream security advisory GHSA-2r2h-jc8w-w66c.
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across Spring Framework 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19 and 7.0.0-7.0.8, where unneutralized CRLF sequences (CWE-93) let an attacker inject into or corrupt the event stream. Reported by VMware/Spring and tagged as Information Disclosure, the flaw can break stream framing and potentially leak or splice data across SSE responses. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), but the vendor-assigned CVSS of 9.8 (all-High impact) sits in tension with the information-disclosure framing and warrants scrutiny.
Cross-response information disclosure and stream corruption affects Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8 (both MVC and WebFlux) when applications serve Server-Sent Events (SSE) together with view fragments, letting remote attackers corrupt the event stream and potentially bleed data across responses. No public exploit is identified at time of analysis and CISA has not listed the flaw in KEV; EPSS is low at 0.15% (5th percentile). The vendor-assigned 9.8 rating sits uneasily against the CWE-93 root cause, the 'Information Disclosure' tagging, and the SSVC 'exploitation: none' status, suggesting the paper severity outruns observed real-world risk.
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream collectors such as rsyslog, Splunk, and Elastic Stack. The escapeStructuredDataValue() function omits C0 control character escaping, so a literal newline embedded in a log property value terminates the current RFC 6587 TCP syslog frame and begins a new one; if the attacker-supplied bytes constitute a valid RFC 5424 header, the downstream collector accepts them as a separate, authentic-looking record. A second injection path exists through unvalidated SD-NAME keys, which can prematurely close structured-data elements. Both paths require the non-default SyslogSinkOptions.includeStructuredData: true setting. Publicly available proof-of-concept code exists; no CISA KEV listing at time of analysis.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.