thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

HTTP Response Splitting

An attack using CRLF injection to make a server emit what a client or cache interprets as two separate HTTP responses.

Definition

By injecting CRLF into a header value, the attacker terminates the header block and supplies an attacker-controlled body, enabling cache poisoning or XSS. Modern frameworks reject CR/LF in headers; validation and encoding are the fixes.

Example

A vulnerable Location header lets an attacker append a fake second response that a proxy caches.

Exam tip

Root cause is CRLF injection into headers.

Related terms