AIKIDO-2026-961622

TL;DR

The multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a Content-Disposition header is not treated as a line break. The bare control characters are passed directly into the parsed filename and field name values handed back to the application. Consuming code that trusts those values can suffer filesystem filename pollution, log forging, or header injection when the value is forwarded to a CR/LF-sensitive sink. The fix rejects header lines that still contain a bare carriage return or line feed and discards multipart field names and filenames that contain bare line breaks.