CVE-2026-32993: HTTP Header Injection Vulnerability

CVE-2026-32993 Overview

CVE-2026-32993 is an HTTP header injection vulnerability in cPanel/WHM. The flaw resides in the /unprotected/nova_error endpoint, which fails to sanitize the status query parameter before reflecting it into HTTP response headers. An unauthenticated remote attacker can inject arbitrary HTTP headers into the response by crafting a malicious request. The issue is tracked under CWE-93: Improper Neutralization of CRLF Sequences. cPanel published a security advisory on May 13, 2026 addressing the defect.

Critical Impact

Unauthenticated attackers can manipulate HTTP responses through CRLF injection, enabling response splitting, cache poisoning, and downstream client-side attacks against cPanel/WHM users.

Affected Products

• cPanel & WHM
• cPanel WP2 (Web Hosting Manager component)
• Deployments exposing the /unprotected/nova_error endpoint

Discovery Timeline

• 2026-05-13 - cPanel releases security advisory and patch
• 2026-05-13 - CVE-2026-32993 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-32993

Vulnerability Analysis

The vulnerability stems from improper neutralization of CRLF (Carriage Return Line Feed) sequences in the status query parameter handled by the /unprotected/nova_error endpoint. The endpoint accepts the parameter and embeds its value into the HTTP response without filtering control characters such as \r and \n. An attacker injecting encoded CRLF sequences can terminate the current header line and append additional response headers or even a forged response body. Because the endpoint is reachable without authentication, exploitation requires only network access to the cPanel/WHM service.

Root Cause

The underlying defect is missing input validation and output encoding on a user-controlled parameter that flows into HTTP response header construction. The application trusts the status value as a safe scalar and does not strip or reject CRLF byte sequences. This pattern matches [CWE-93], where the lack of CRLF neutralization allows attackers to alter the protocol-level structure of responses.

Attack Vector

Exploitation occurs over the network against the cPanel/WHM HTTP service. An attacker crafts a request such as GET /unprotected/nova_error?status=<URL-encoded CRLF + injected header> and induces a victim or proxy to issue it. The server then emits the attacker-controlled bytes as part of its response headers. Practical impact includes HTTP response splitting, web cache poisoning, reflected cross-site scripting through injected Content-Type and body content, session fixation through forged Set-Cookie headers, and open-redirect-style abuse through injected Location headers. The scope change reflected in the CVSS vector indicates that exploitation can affect components beyond the vulnerable endpoint, including intermediary caches and browser sessions. Refer to the cPanel Security Advisory for CVE-2026-32993 for vendor-supplied technical details.

Detection Methods for CVE-2026-32993

Indicators of Compromise

• HTTP requests to /unprotected/nova_error containing URL-encoded CRLF sequences such as %0d%0a, %0D%0A, \r\n, or raw control bytes in the status parameter.
• Web server access logs showing unusually long status parameter values or values containing header-like tokens (Set-Cookie:, Location:, Content-Type:).
• Downstream cache entries or proxy logs containing duplicated or unexpected response headers tied to the nova_error path.

Detection Strategies

• Inspect cPanel/WHM access logs for requests to /unprotected/nova_error and decode the status parameter, flagging any value containing CR, LF, or %0d/%0a byte sequences.
• Deploy a WAF or reverse proxy rule that rejects requests where query parameters contain raw or encoded CRLF characters.
• Correlate inbound request patterns with outbound response anomalies such as duplicated header names or unexpected Set-Cookie values.

Monitoring Recommendations

• Enable verbose logging on the cPanel/WHM HTTP front end and forward logs to a centralized analytics platform for query parameter inspection.
• Monitor for spikes in 4xx/5xx responses from /unprotected/nova_error, which may indicate exploitation attempts or scanning.
• Track upstream cache hit ratios and cookie-issuance patterns to identify response splitting or cache poisoning side effects.

How to Mitigate CVE-2026-32993

Immediate Actions Required

• Apply the cPanel/WHM security update released on May 13, 2026 as documented in the vendor advisory.
• Restrict network exposure of cPanel/WHM management interfaces to trusted administrative networks where feasible.
• Deploy a WAF rule that blocks CRLF byte sequences in query string parameters destined for /unprotected/nova_error.

Patch Information

cPanel issued a fixed build alongside the cPanel Security Update CVE-2026-32993. Operators running cPanel/WHM and WP2 should upgrade to the patched version listed in the advisory. Verify the running build with /usr/local/cpanel/cpanel -V and confirm it matches or exceeds the version published by cPanel.

Workarounds

• Front the cPanel/WHM service with a reverse proxy that strips or rejects CRLF characters in query parameters until patching is complete.
• Block external access to /unprotected/nova_error at the perimeter if the endpoint is not required for normal operations.
• Disable response caching for cPanel/WHM responses to limit the blast radius of any response-splitting attempt.

# Example WAF/Nginx snippet to drop requests with CRLF in query strings
if ($query_string ~* "(%0d|%0a|\r|\n)") {
    return 400;
}