CWE-93
AllowedImproper Neutralization of CRLF Sequences ('CRLF Injection')
Abstraction: Base · Status: Draft
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
433 vulnerabilities reference this CWE, most recent first.
GHSA-57H4-P8XG-X38X
Vulnerability from github – Published: 2026-05-18 09:31 – Updated: 2026-05-19 15:31Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.
The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
Note that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.
{
"affected": [],
"aliases": [
"CVE-2026-8788"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-18T08:16:15Z",
"severity": "HIGH"
},
"details": "Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.",
"id": "GHSA-57h4-p8xg-x38x",
"modified": "2026-05-19T15:31:22Z",
"published": "2026-05-18T09:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8788"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.10.1/changes"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-599G-P68Q-2RXV
Vulnerability from github – Published: 2023-05-30 06:30 – Updated: 2024-05-02 03:30Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors.
Note: This issue is present due to an incomplete fix for CVE-2020-11709.
{
"affected": [],
"aliases": [
"CVE-2023-26130"
],
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-77",
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-30T05:15:10Z",
"severity": "HIGH"
},
"details": "Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors.\n\n**Note:** This issue is present due to an incomplete fix for [CVE-2020-11709](https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-2366507).",
"id": "GHSA-599g-p68q-2rxv",
"modified": "2024-05-02T03:30:32Z",
"published": "2023-05-30T06:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26130"
},
{
"type": "WEB",
"url": "https://github.com/yhirose/cpp-httplib/commit/5b397d455d25a391ba346863830c1949627b4d08"
},
{
"type": "WEB",
"url": "https://gist.github.com/dellalibera/094aece17a86069a7d27f93c8aba2280"
},
{
"type": "WEB",
"url": "https://github.com/yhirose/cpp-httplib/releases/tag/v0.12.4"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2RY6PKBU73I45L6YWNYCUK2XBEXEFX7L"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JY2E7EIRWQMKH6GY4OZOWWBZBY3Q7CGS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYODHZECXYFC2BNODZPZXZAXOKGMCYAP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6MO4FSKYNSAJVUXYP7LRY7ARUIGKBFL"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-5591194"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-59GX-X7R4-97Q5
Vulnerability from github – Published: 2022-05-14 01:05 – Updated: 2022-05-14 01:05Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.
{
"affected": [],
"aliases": [
"CVE-2019-10678"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-31T21:29:00Z",
"severity": "HIGH"
},
"details": "Domoticz before 4.10579 neglects to categorize \\n and \\r as insecure argument options.",
"id": "GHSA-59gx-x7r4-97q5",
"modified": "2022-05-14T01:05:53Z",
"published": "2022-05-14T01:05:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10678"
},
{
"type": "WEB",
"url": "https://github.com/domoticz/domoticz/commit/2119afbe74ee0c914c1d5c4c859c594c08b0ad42"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/46773"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/152678/Domoticz-4.10577-Unauthenticated-Remote-Command-Execution.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5F3W-CMWX-C9M9
Vulnerability from github – Published: 2026-04-20 06:31 – Updated: 2026-04-20 06:31SD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of CRLF sequences ('CRLF Injection') vulnerability. Processing some crafted configuration data may lead to arbitrary entries injected to the system configuration.
{
"affected": [],
"aliases": [
"CVE-2026-32964"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-20T04:16:45Z",
"severity": "MODERATE"
},
"details": "SD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of CRLF sequences (\u0027CRLF Injection\u0027) vulnerability. Processing some crafted configuration data may lead to arbitrary entries injected to the system configuration.",
"id": "GHSA-5f3w-cmwx-c9m9",
"modified": "2026-04-20T06:31:27Z",
"published": "2026-04-20T06:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32964"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU94271449"
},
{
"type": "WEB",
"url": "https://www.silex.jp/support/security-advisories/2026-001"
},
{
"type": "WEB",
"url": "https://www.silex.jp/support/security-advisories/en/2026-001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5GGV-4372-HVMC
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2024-04-04 01:34cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).
{
"affected": [],
"aliases": [
"CVE-2016-10803"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-07T13:15:00Z",
"severity": "HIGH"
},
"details": "cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).",
"id": "GHSA-5ggv-4372-hvmc",
"modified": "2024-04-04T01:34:22Z",
"published": "2022-05-24T16:52:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10803"
},
{
"type": "WEB",
"url": "https://documentation.cpanel.net/display/CL/58+Change+Log"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5R9G-QH6M-JXFF
Vulnerability from github – Published: 2023-02-16 20:46 – Updated: 2023-02-16 20:46Impact
undici library does not protect host HTTP header from CRLF injection vulnerabilities.
Patches
This issue was patched in Undici v5.19.1.
Workarounds
Sanitize the headers.host string before passing to undici.
References
Reported at https://hackerone.com/reports/1820955.
Credits
Thank you to Zhipeng Zhang (@timon8) for reporting this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "undici"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "5.19.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-23936"
],
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-16T20:46:30Z",
"nvd_published_at": "2023-02-16T18:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nundici library does not protect `host` HTTP header from CRLF injection vulnerabilities.\n\n### Patches\n\nThis issue was patched in Undici v5.19.1.\n\n### Workarounds\n\nSanitize the `headers.host` string before passing to undici.\n\n### References\n\nReported at https://hackerone.com/reports/1820955.\n\n### Credits\n\nThank you to Zhipeng Zhang ([@timon8](https://hackerone.com/timon8)) for reporting this vulnerability. ",
"id": "GHSA-5r9g-qh6m-jxff",
"modified": "2023-02-16T20:46:30Z",
"published": "2023-02-16T20:46:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23936"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1820955"
},
{
"type": "PACKAGE",
"url": "https://github.com/nodejs/undici"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/releases/tag/v5.19.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "CRLF Injection in Nodejs \u2018undici\u2019 via host"
}
GHSA-5VG9-5847-VVMQ
Vulnerability from github – Published: 2026-06-17 13:53 – Updated: 2026-06-17 13:53Summary
A CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses.
Description
Laravel applications that send email to addresses provided by users — for example during authentication flows or contact forms — may be vulnerable to manipulation of outbound mail content if the address is not adequately sanitized before it reaches the mail transport layer. An attacker who can supply an email address to such a flow may, under certain conditions, be able to influence the content of emails sent by the application, cause those emails to be delivered to unintended recipients, or cause the application's mail server to send unintended messages.
Impact
Affected applications may be exposed to unauthorized access and mail relay abuse. The severity depends on what the application sends by email and how its mail infrastructure is configured.
Remediation
Upgrade to version 12.60.0 or later, or 13.10.0 or later.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 13.9.0"
},
"package": {
"ecosystem": "Packagist",
"name": "laravel/framework"
},
"ranges": [
{
"events": [
{
"introduced": "13.0.0"
},
{
"fixed": "13.10.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "laravel/framework"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.60.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-17T13:53:44Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\nA CRLF injection vulnerability in Laravel\u0027s email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses.\n\n## Description\nLaravel applications that send email to addresses provided by users \u2014 for example during authentication flows or contact forms \u2014 may be vulnerable to manipulation of outbound mail content if the address is not adequately sanitized before it reaches the mail transport layer.\nAn attacker who can supply an email address to such a flow may, under certain conditions, be able to influence the content of emails sent by the application, cause those emails to be delivered to unintended recipients, or cause the application\u0027s mail server to send unintended messages.\n\n## Impact\nAffected applications may be exposed to unauthorized access and mail relay abuse. The severity depends on what the application sends by email and how its mail infrastructure is configured.\n\n## Remediation\nUpgrade to version 12.60.0 or later, or 13.10.0 or later.",
"id": "GHSA-5vg9-5847-vvmq",
"modified": "2026-06-17T13:53:44Z",
"published": "2026-06-17T13:53:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/laravel/framework/security/advisories/GHSA-5vg9-5847-vvmq"
},
{
"type": "PACKAGE",
"url": "https://github.com/laravel/framework"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Laravel Framework: CRLF injection in default email rule "
}
GHSA-5XQ5-HX4G-F5V6
Vulnerability from github – Published: 2026-08-23 21:31 – Updated: 2026-08-25 21:31Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line.
PSGI hands PATH_INFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it. The proxy appends that byte string to the upstream base URL, and for an Upgrade tunnel writes it into a request line it serializes itself, re-encoding nothing in either path. The HTTP client that sends the resulting URL does not validate the target either. A path containing %0d%0a therefore arrives at the upstream as a CRLF that ends the request line, and a decoded space, '?' or '#' truncates it the same way.
Everything the client writes after the CRLF is read by the upstream as a second request. On the buffered path it arrives on a keep-alive connection the proxy pools and reuses for other clients. Its method, path and headers are all chosen by the client, and the upstream attributes it to the proxy, so it reaches upstream paths that the proxy's own routing does not expose.
{
"affected": [],
"aliases": [
"CVE-2026-75922"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-23T19:16:28Z",
"severity": "MODERATE"
},
"details": "Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line.\n\nPSGI hands PATH_INFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it. The proxy appends that byte string to the upstream base URL, and for an Upgrade tunnel writes it into a request line it serializes itself, re-encoding nothing in either path. The HTTP client that sends the resulting URL does not validate the target either. A path containing %0d%0a therefore arrives at the upstream as a CRLF that ends the request line, and a decoded space, \u0027?\u0027 or \u0027#\u0027 truncates it the same way.\n\nEverything the client writes after the CRLF is read by the upstream as a second request. On the buffered path it arrives on a keep-alive connection the proxy pools and reuses for other clients. Its method, path and headers are all chosen by the client, and the upstream attributes it to the proxy, so it reaches upstream paths that the proxy\u0027s own routing does not expose.",
"id": "GHSA-5xq5-hx4g-f5v6",
"modified": "2026-08-25T21:31:21Z",
"published": "2026-08-23T21:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75922"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/LNATION/Reverse-Proxy-0.03/source/Proxy.xs#L386-399"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/LNATION/Reverse-Proxy-0.03/source/Proxy.xs#L654-666"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/LNATION/Reverse-Proxy-0.04/changes"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/LNATION/Reverse-Proxy-0.04/source/Proxy.xs#L400-426"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/23/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-66X7-2R56-FJ77
Vulnerability from github – Published: 2022-05-14 01:36 – Updated: 2024-09-13 17:51www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "buildbot"
},
"ranges": [
{
"events": [
{
"introduced": "0.9.0"
},
{
"fixed": "1.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-7313"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-19T21:17:46Z",
"nvd_published_at": "2019-02-03T08:29:00Z",
"severity": "MODERATE"
},
"details": "`www/resource.py` in Buildbot before 1.8.1 allows CRLF injection in the Location header of `/auth/login` and `/auth/logout` via the redirect parameter. This affects other web sites in the same domain.",
"id": "GHSA-66x7-2r56-fj77",
"modified": "2024-09-13T17:51:51Z",
"published": "2022-05-14T01:36:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7313"
},
{
"type": "WEB",
"url": "https://github.com/buildbot/buildbot/pull/4584"
},
{
"type": "WEB",
"url": "https://github.com/buildbot/buildbot/commit/e781f110933e05ecdb30abc64327a2c7c9ff9c5a"
},
{
"type": "PACKAGE",
"url": "https://github.com/buildbot/buildbot"
},
{
"type": "WEB",
"url": "https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/buildbot/PYSEC-2019-7.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Buildbot CRLF Injection"
}
GHSA-687M-WFRP-8MXF
Vulnerability from github – Published: 2026-09-11 12:33 – Updated: 2026-09-11 12:33The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.
{
"affected": [],
"aliases": [
"CVE-2026-86813"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-11T11:16:57Z",
"severity": "MODERATE"
},
"details": "The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.",
"id": "GHSA-687m-wfrp-8mxf",
"modified": "2026-09-11T12:33:25Z",
"published": "2026-09-11T12:33:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86813"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/afda2a26-b965-42cb-85a8-4a4d83ec026e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Avoid using CRLF as a special sequence.
Mitigation
Appropriately filter or quote CRLF sequences in user-controlled input.
CAPEC-15: Command Delimiters
An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.