OWASPASVS 5.0 requirement

ASVS-V4.2.4 The application only accepts http/2 and http/3 requests where the header fields and values do not contain any cr (\r), lf (\n), or crlf…

L3 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V4 API and Web Service
Section: V4.2 HTTP Message Structure Validation
Level: L3 (requirement applies from this verification level up)

Requirement

Verify that the application only accepts HTTP/2 and HTTP/3 requests where the header fields and values do not contain any CR (\r), LF (\n), or CRLF (\r\n) sequences, to prevent header injection attacks.