I'm looking for a vulnerable CRLF environment. So far I've tested PHP and JSP.
In PHP 5.6,
header gives you a warning if you try to insert a newline:
<b>Warning</b>: Header may not contain more than a single header, new line detected in
In Java 1.8 + Tomcat 7.0.78,
response.setHeader replaces the
\r\n symbols with spaces.
So, starting from which version did Java and PHP fix the CRLF vulnerability?