topic Re: Qlikvew Webserver - CRLF injection/HTTP response splitting in QlikView

Qlikvew Webserver - CRLF injection/HTTP response splitting

Mon, 26 Jan 2026 18:19:17 GMT

I've tried to look for a solution for this issue, but my experience is limited.

I'm -still- using QV 11.0.11282.0

Any help would be appreciated

Re: Qlikvew Webserver - CRLF injection/HTTP response splitting

Giuseppe_Novello — Fri, 18 Jul 2014 18:47:39 GMT

Hugo,

This is reported in bug # 64659 and close as "obsolete" for the following reason( according R&D):

" The reported security vulnerability is a false-positive. It is true that the test string “SomeCustomInjectedHeader: injected” is returned by the server, but the CRLF characters are not integrated by the server in the response, and as a consequence the test string is never interpreted by the receiving browser as a header."

As always to be safe, implement SSL and V11.00 SR1 is really old and not longer patchable for that upgrade to V11.20 SR7.

Re: Qlikvew Webserver - CRLF injection/HTTP response splitting

Fri, 18 Jul 2014 20:16:30 GMT

Grazie Giuseppe!

Exactly the answer I was hoping for. I'll work now with my superiors to upgrade my QV

Thanks again

Re: Qlikvew Webserver - CRLF injection/HTTP response splitting

Anonymous — Mon, 25 May 2015 06:23:08 GMT

Hi Giuseppe,

May I ask something about security vulnerability caused by HTTP header injection?

What I'd like to ask you is whether we can avoid any security vulnerability caused by HTTP header injection because QlikView doesn't integrate the CRLF characters in the response.

Many thanks,

Miki Eto

Re: Qlikvew Webserver - CRLF injection/HTTP response splitting

Bill_Britt — Tue, 26 May 2015 11:53:04 GMT

Hi,

From my understanding the CRLF characters are not integrated by the server in the response, and is never understood by the browser as a header.

Bill

Re: Qlikvew Webserver - CRLF injection/HTTP response splitting

Anonymous — Wed, 27 May 2015 03:13:56 GMT

Thanks, Bill.