CVE-2006-5330

CVE-2006-5330 is a medium-severity vulnerability in Adobe Flash Player with a CVSS 2.0 base score of 5.0. Its EPSS exploit-prediction score of 23% places it in the 97th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-79.

Key facts

Description

CRLF injection vulnerability in Adobe Flash Player plugin 9.0.16 and earlier for Windows, 7.0.63 and earlier for Linux, 7.x before 7.0 r67 for Solaris, and before 9.0.28.0 for Mac OS X, allows remote attackers to modify HTTP headers of client requests and conduct HTTP Request Splitting attacks via CRLF sequences in arguments to the ActionScript functions (1) XML.addRequestHeader and (2) XML.contentType. NOTE: the flexibility of the attack varies depending on the type of web browser being used.

Frequently asked questions

What is CVE-2006-5330?
CRLF injection vulnerability in Adobe Flash Player plugin 9.0.16 and earlier for Windows, 7.0.63 and earlier for Linux, 7.x before 7.0 r67 for Solaris, and before 9.0.28.0 for Mac OS X, allows remote attackers to modify HTTP headers of client requests and conduct HTTP Request Splitting attacks via CRLF sequences in arguments to the ActionScript functions (1) XML.addRequestHeader and (2) XML.contentType. NOTE: the flexibility of the attack varies depending on the type of web browser being used.
How severe is CVE-2006-5330?
CVE-2006-5330 has a CVSS 2.0 base score of 5.0, rated medium severity.
Is CVE-2006-5330 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 23% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2006-5330?
CVE-2006-5330 primarily affects Adobe Flash Player. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2006-5330?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2006-5330 published?
CVE-2006-5330 was published on 2006-10-17 and last updated on 2026-06-16.

References

Affected products (4)

More vulnerabilities in Adobe Flash Player

All CVEs affecting Adobe Flash Player →

Other CWE-79 (Cross-site Scripting (XSS)) vulnerabilities

Browse all CWE-79 (Cross-site Scripting (XSS)) vulnerabilities →