HTTP header injection

Also known as HTTP injection, CWE-113

web application vulnerability that occurs when HTTP headers are dynamically generated from user input; can allow for HTTP response splitting, session fixation (via Set-Cookie), cross-site scripting, and malicious redirect attacks