urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
Metrics
Affected Vendors & Products
Advisories
Source | ID | Title |
---|---|---|
![]() |
DLA-2686-1 | python-urllib3 security update |
![]() |
DLA-3610-1 | python-urllib3 security update |
![]() |
EUVD-2020-0230 | urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116. |
![]() |
GHSA-wqvq-5m8c-6g24 | CRLF injection in urllib3 |
![]() |
USN-4570-1 | urllib3 vulnerability |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.

Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2024-08-04T15:49:07.138Z
Reserved: 2020-09-29T00:00:00
Link: CVE-2020-26137

No data.

Status : Modified
Published: 2020-09-30T18:15:26.773
Modified: 2024-11-21T05:19:19.680
Link: CVE-2020-26137


No data.