CVE-2002-1405: Elinks

Medium severity, CVSS 5.0. EPSS: 5% chance of exploitation in the next 30 days.

CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters.

Affected products

• Elinks Elinks: version 0.2.4 only; version 0.3.2 only
• Links Links: version 0.96 only
• University Of Kansas Lynx: version 2.8.2_rel1 only; version 2.8.3 only; version 2.8.3_rel1 only; version 2.8.4 only; version 2.8.4_rel1 only; version 2.8.5_dev8 only

Published 2003-02-19. Last modified 2026-06-16.