# Header field injection via unescaped delimiters

User values concatenated into headers or structured fields without rejecting CR, LF, or delimiters

_Area: Web injection and code execution. Seen in 3 disclosed reports; 2 confirmed bounties: $100 and $3,134; latest 2026-07-02. Updated 2026-10-24._

## How it works
Code builds a protocol header or structured field by concatenating user-controlled values, assuming those values contain no delimiters. When the delimiter (semicolon, comma, CR/LF, or a proprietary separator) is not rejected, the user's value splits into extra fields or overrides existing ones. Downstream parsers then read attacker-chosen values as trusted data. The broken assumption is that a value stays a value; without escaping, it becomes structure.

## Where it shows up
- User input (push options, form params, calendar properties, SIP headers) concatenated into a header string with a fixed delimiter.
- Filters that blocklist a few bad names instead of whitelisting allowed ones [E3](https://bugbountylibrary.com/r/h1%3A3789570.md).
- Multiple services parsing the same internal header with last-write-wins map semantics (E1-specific) [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-rce-vulnerability-cve-2026-3854.md).
- Parameters reflected into `Set-Cookie` without stripping commas/semicolons [E2](https://bugbountylibrary.com/r/blog%3Ablog-miki-it-2013-9-15-xsrf-cookie-setting-google.md).
- Legacy or proprietary `X-` fields still parsed after deprecation [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-rce-vulnerability-cve-2026-3854.md).

## How to review
Trace every user-controlled value to the point where it is placed into a header or structured field. The invariant: either the value is rejected when it contains the delimiter, CR, or LF, or it is escaped/encoded so it cannot terminate or extend the field. For filters, confirm they are allowlists of permitted header names, not blocklists [E3](https://bugbountylibrary.com/r/h1%3A3789570.md). For shared internal headers, check whether any parser uses last-write-wins and whether a user value can produce a duplicate key [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-rce-vulnerability-cve-2026-3854.md). For reflected values, confirm the sink strips delimiters before writing the header [E2](https://bugbountylibrary.com/r/blog%3Ablog-miki-it-2013-9-15-xsrf-cookie-setting-google.md).

## Variants seen
- Semicolon injection into a delimited internal header, overriding security fields [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-rce-vulnerability-cve-2026-3854.md).
- Inconsistent parsing of structured fields plus undocumented `X-` properties reaching renderers, SMTP, and URI handlers [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-rce-vulnerability-cve-2026-3854.md).
- Comma/semicolon injection into `Set-Cookie` enabling cookie injection via folding in browsers that still support it (Safari) [E2](https://bugbountylibrary.com/r/blog%3Ablog-miki-it-2013-9-15-xsrf-cookie-setting-google.md).
- Blocklist filter leaving arbitrary SIP headers to reach the INVITE builder [E3](https://bugbountylibrary.com/r/h1%3A3789570.md).

## Why fixes fail
Blocklist filtering leaves unlisted headers through [E3](https://bugbountylibrary.com/r/h1%3A3789570.md). Deprecated properties remain parsed, so removing them from docs does not remove the sink [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-rce-vulnerability-cve-2026-3854.md). Sanitizing one service in a shared pipeline leaves other parsers of the same header exposed [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-rce-vulnerability-cve-2026-3854.md).

## Impact and severity
Ranged from cookie tampering [E2](https://bugbountylibrary.com/r/blog%3Ablog-miki-it-2013-9-15-xsrf-cookie-setting-google.md) and Caller ID spoofing [E3](https://bugbountylibrary.com/r/h1%3A3789570.md) to stored XSS and SMTP injection [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-rce-vulnerability-cve-2026-3854.md), up to unsandboxed RCE [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-rce-vulnerability-cve-2026-3854.md). Severity rises when the injected field controls security settings [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-rce-vulnerability-cve-2026-3854.md) or when many parsers disagree on the same input [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-rce-vulnerability-cve-2026-3854.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-rce-vulnerability-cve-2026-3854.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-miki-it-2013-9-15-xsrf-cookie-setting-google.md
- E3: https://bugbountylibrary.com/r/h1%3A3789570.md