I'm looking for a vulnerable CRLF environment. So far I've tested PHP and JSP.

In PHP 5.6, header gives you a warning if you try to insert a newline:

<b>Warning</b>:  Header may not contain more than a single header, new line detected in

In Java 1.8 + Tomcat 7.0.78, response.setHeader replaces the \r\n symbols with spaces.

So, starting from which version did Java and PHP fix the CRLF vulnerability?


2 Answers 2

  • PHP - 4.2.1 - CVE - Or see the Anders answer.

  • TOMCAT - Before 6.0.37 / 7.0.30 - CVE

Since CRLF Injection is directly related to HTTP response splitting attacks, I recommend you to read the question I asked, here. The answer was above my expectation.


For some reasons, I needed to test some PHP header injections today. @Anders is right, the exploit I linked in the CVE is much more difficult to execute than the exploit stated in his answer below.

  • 3
    The CVE you link to for PHP is related to some more obscure exploit. Up until 5.1.2 you could insert newlines right into the header function. See my answer.
    – Anders
    Nov 6, 2017 at 12:44

For PHP, the changelog in the manual for header has the following to say:

5.1.2 This function now prevents more than one header to be sent at once as a protection against header injection attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .