CRLF means carriage return and line feed, the control characters used to mark the end of a line in text protocols. In HTTP, they help separate headers and define message structure. Because web servers, proxies, and browsers rely on those delimiters, a stray CRLF can change how a request is parsed.
In security, CRLF matters because attackers may inject newline characters into a header or other text field. If one component treats the input as the end of a line while another interprets it differently, the result can be header injection, response splitting, or request smuggling. That parsing mismatch can confuse request boundaries, poison queues or caches, and sometimes expose authenticated traffic. Defenders reduce the risk by stripping control characters, validating header data, and testing front-end and back-end systems for parser disagreement.