Re: Disallow newlines in CURLOPT_HTTPHEADER

On Thu, 9 Jul 2026 at 09:21, Sjoerd Langkemper <sjoerd-php@linuxonly.nl> wrote: > I propose to not allow newlines in header values. Any thoughts on > this? Should this first raise a deprecation warning before throwing a value > error? > Thanks for noticing this, while header injection vulnerabilities aren't that common, it's still a problem. I just wanted to note that the header() function rejects newlines (since 5.1.2): header("Hello: world\r\nFoo: bar"); Warning: Header may not contain more than a single header, new line detected in [...] The header is simply not sent. https://github.com/php/php-src/blob/9dc29aafa5eecc71a9f9e2c7607b588597a91810/main/SAPI.c#L760 https://github.com/php/php-src/commit/f2415625d4848b503f1fbcc7986211d6eb4aa7df Craig