CWEweakness
CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax
High
Official page ↗
- Abstraction
- Variant
- Structure
- Simple
- Status
- Incomplete
- Likelihood of exploit
- High
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
Common consequences
• Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands — The header may contain a script that will get executed in the client's browser context, potentially resulting in a cross site scripting vulnerability or possibly an HTTP response splitting attack.
• Confidentiality: Read Application Data — Attackers may be able to obtain sensitive information.
Potential mitigations
• [Architecture and Design] Carefully control data that is being placed both in HTTP response headers and in the HTTP response body to ensure that no scripting syntax is present, taking various encodings into account. Perform output validation in order to filter/escape/encode unsafe data that is being passed from the server in an HTTP response header.
• [Architecture and Design] Disable script execution functionality in the clients' browser.
Observed examples
• CVE-2006-3918: Web server does not remove the Expect header from an HTTP request when it is reflected back in an error message, allowing a Flash SWF file to perform XSS attacks.
Related
Observed example · CVE (1)
- CVE-2006-3918 http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before… vulnerability
Child of · CWE (1)
- CWE-116 Improper Encoding or Escaping of Output weakness
Referenced by CVE · weakness (65)
- CVE-2026-110723 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from… vulnerability
- CVE-2026-69183 Monkeytype is a minimalistic and customizable typing test. vulnerability
- CVE-2026-66778 SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. vulnerability
- CVE-2026-67179 Genkit does not properly validate host request headers. vulnerability
- CVE-2026-72574 A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of… vulnerability
- CVE-2026-0516 A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the… vulnerability
- CVE-2026-48061 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. vulnerability
- CVE-2026-21762 HCL DevOps Loop is affected by missing HTTP security headers. vulnerability
- CVE-2026-54477 The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks. vulnerability
- CVE-2026-55791 Craft CMS is a content management system (CMS). vulnerability
- CVE-2024-51454 IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim… vulnerability
- CVE-2026-10836 Improper handling of HTTP headers that allows a remote attacker to manipulate the value of the Host header using specially crafted requests. vulnerability
- CVE-2026-4096 IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. vulnerability
- CVE-2026-48126 Algernon is a small self-contained pure-Go web server. vulnerability
- CVE-2026-33805 @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy… vulnerability
- CVE-2025-66485 IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. vulnerability
- CVE-2026-33149 Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. vulnerability
- CVE-2025-14807 IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to HTTP header injection, caused by improper validation of input… vulnerability
- CVE-2025-13213 IBM Aspera Orchestrator 3.0.0 through 4.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST… vulnerability
- CVE-2025-36227 IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST… vulnerability
- CVE-2025-70948 A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and… vulnerability
- CVE-2026-1698 A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included,… vulnerability
- CVE-2026-26747 A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in… vulnerability
- CVE-2025-27901 IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to HTTP header… vulnerability
- CVE-2026-26234 JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override… vulnerability
- CVE-2024-51451 IBM Concert 1.0.0 through 2.1.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. vulnerability
- CVE-2025-52660 HCL AION is affected by an Unrestricted File Upload vulnerability. vulnerability
- CVE-2025-64425 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. vulnerability
- CVE-2025-67724 Tornado is a Python web framework and asynchronous networking library. vulnerability
- CVE-2025-13803 A vulnerability was identified in MediaCrush 1.0.0/1.0.1. vulnerability