Re: [PHP-DEV] Disallow newlines in CURLOPT_HTTPHEADER

On Thu, 9 Jul 2026 at 09:21, Sjoerd Langkemper <[email protected]>
wrote:

> I propose to not allow newlines in header values. Any thoughts on
> this? Should this first raise a deprecation warning before throwing a value
> error?
>


Thanks for noticing this, while header injection vulnerabilities aren't
that common, it's still a problem.

I just wanted to note that the header() function rejects newlines (since
5.1.2):

header("Hello: world\r\nFoo: bar");


Warning: Header may not contain more than a single header, new line
detected in [...]

The header is simply not sent.

https://github.com/php/php-src/blob/9dc29aafa5eecc71a9f9e2c7607b588597a91810/main/SAPI.c#L760

https://github.com/php/php-src/commit/f2415625d4848b503f1fbcc7986211d6eb4aa7df

Craig