HTTP Response Header Injection Vulnerability in HCL AION

CVE-2026-21850

What is CVE-2026-21850?

HCL AION is susceptible to a security vulnerability that arises when user-controlled input is improperly handled in HTTP response headers. This lack of adequate neutralization of carriage return and line feed (CR/LF) characters allows for potential header injection or response splitting attacks. Such a scenario could lead to unintended behaviors in web applications or expose sensitive information, compromising overall security under specific conditions.

References