Skip to content

fix: sanitize header values to prevent HTTP header injection (#506)#812

Merged
benoitc merged 1 commit intomasterfrom
fix/506-header-injection
Jan 19, 2026
Merged

fix: sanitize header values to prevent HTTP header injection (#506)#812
benoitc merged 1 commit intomasterfrom
fix/506-header-injection

Conversation

@benoitc
Copy link
Copy Markdown
Owner

@benoitc benoitc commented Jan 19, 2026

Summary

  • Sanitize header values by stripping CR and LF characters during serialization
  • Prevents HTTP header injection attacks where newlines in header values could inject additional headers
  • Also sanitizes parameter values in headers with parameters (e.g., Content-Type)

Fixes #506
@benoitc
fix: sanitize header values to prevent HTTP header injection (#506)
3000a39 
Header values containing CR or LF characters could be used for HTTP
header injection attacks. This fix strips CR and LF characters from
header values during serialization in to_iolist/1.

The sanitization is also applied to parameter values in
Content-Type and similar headers with parameters.

Fixes #506
@benoitc benoitc merged commit 9d0eb82 into master Jan 19, 2026
5 checks passed
@benoitc benoitc deleted the fix/506-header-injection branch January 19, 2026 16:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant

@benoitc