CRLF

Cybersecuritynews •Abinaya • August 20, 2026

A limited CRLF injection flaw can be escalated into a severe HTTP desynchronization attack, poisoning CDN caches and delivering XSS payloads to users on legitimate websites. The attack, called CRLF-Powered Desync, begins when an application incorrectly handles encoded carriage return and line feed characters, commonly represented as %0d%0a. These characters mark new lines in HTTP messages. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CRLF-Powered Desync Attacks Enable Account Hijacking and Cookie Theft Security researchers have identified a new category of HTTP request smuggling attacks termed 'CRLF-Powered Desync Attacks.' These attacks exploit a CRLF injection vulnerability, allowing attackers to hijack user accounts and steal HTTPOnly cookies. The method involves improperly handled carriage return and line feed characters in HTTP headers, leading to potential cache poisoning and the delivery of malicious payloads. Affected systems include various web applications that fail to sanitize input properly. The researchers warn that this vulnerability can escalate into self-propagating desynchronization worms. Organizations using vulnerable web applications are at risk of significant data breaches. The attack vector is particularly concerning due to its potential for widespread exploitation. Security teams are advised to review their HTTP header handling practices to mitigate this risk. 2 sources 68

CRLF

The full story

Extracted Entities

CWE Weaknesses (1)

Vulnerabilities (2)