cwe-93-crlf-injection

Sanitize Java HTTP headers and redirects against CRLF injection.

3|1|Updated Mar 6, 2026

Search Tags:#security #remediation #java #sast #cwe-93 #crlf injection

Ready to run

npx skills add https://github.com/DevelopersCoffee/java-cwe-security-skills --skill cwe-93-crlf-injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cwe-93-crlf-injection
Source: https://github.com/DevelopersCoffee/java-cwe-security-skills/tree/main/cwe-93-crlf-injection
Command: npx skills add https://github.com/DevelopersCoffee/java-cwe-security-skills --skill cwe-93-crlf-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses and remediates the CWE-93 CRLF Injection vulnerability in Java applications, preventing potential security breaches through malicious header manipulation or redirect attacks.

Core Features & Use Cases

Vulnerability Identification: Detects patterns of CRLF injection in HTTP headers and redirects.
Deterministic Remediation: Provides secure code implementations to sanitize input and prevent CRLF injection.
Use Case: Automatically refactor Java code that directly uses user input in response.setHeader() or response.sendRedirect() to use safe, sanitized versions.

Quick Start

Use the cwe-93-crlf-injection skill to fix CRLF injection vulnerabilities in the provided Java code.

Frequently Asked Questions about cwe-93-crlf-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent CRLF injection in Java HTTP headers and redirects?▼

To prevent CRLF injection in Java HTTP headers and redirects, sanitize user input by replacing CR/LF characters and applying URL encoding to redirect URLs before passing them to response methods.

What is CWE-93 CRLF injection and how does it affect Java applications?▼

CWE-93 CRLF injection is a vulnerability where attackers manipulate HTTP headers or redirects by injecting malicious carriage return and line feed characters into unsanitized user input within Java response objects.

How do I sanitize user input for setHeader and sendRedirect in Java?▼

Sanitize user input for setHeader and sendRedirect in Java by applying string replacement to strip CR/LF characters from header values and using URL encoding for redirect target URLs.

Does this CRLF injection remediation work for all Java web applications?▼

This CRLF injection remediation works for Java web applications that directly use user input in response.setHeader or response.sendRedirect, specifically targeting vulnerabilities identified through static application security testing.

What is the best way to fix SAST detected CRLF injection vulnerabilities in Java?▼

The best way to fix SAST detected CRLF injection vulnerabilities in Java is to deterministically refactor vulnerable code by replacing CR/LF characters in headers and URL encoding redirect parameters to sanitize inputs.