I'm looking for a vulnerable CRLF environment. So far I've tested PHP and JSP.

In PHP 5.6, header gives you a warning if you try to insert a newline:

<b>Warning</b>:  Header may not contain more than a single header, new line detected in

In Java 1.8 + Tomcat 7.0.78, response.setHeader replaces the \r\n symbols with spaces.

So, starting from which version did Java and PHP fix the CRLF vulnerability?

  • PHP - 4.2.1 - CVE - Or see the Anders answer.

  • TOMCAT - Before 6.0.37 / 7.0.30 - CVE

Since CRLF Injection is directly related to HTTP response splitting attacks, I recommend you to read the question I asked, here. The answer was above my expectation.


For some reasons, I needed to test some PHP header injections today. @Anders is right, the exploit I linked in the CVE is much more difficult to execute than the exploit stated in his answer below.

  • 3
    The CVE you link to for PHP is related to some more obscure exploit. Up until 5.1.2 you could insert newlines right into the header function. See my answer. – Anders Nov 6 '17 at 12:44

For PHP, the changelog in the manual for header has the following to say:

5.1.2 This function now prevents more than one header to be sent at once as a protection against header injection attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.