CVE-2016-5699

MEDIUM

CPython <2.7.10, <3.4.4 - RCE

Title source: llm

Description

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

Exploits (2)

nomisec WORKING POC 4 stars
by bunseokbot · poc
https://github.com/bunseokbot/CVE-2016-5699-poc
nomisec WORKING POC
by shajinzheng · poc
https://github.com/shajinzheng/cve-2016-5699-jinzheng-sha

Scores

CVSS v3 6.1
EPSS 0.3528
EPSS Percentile 97.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE
CWE-113
Status draft

Affected Products (27)

python/python < 2.7.9
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
... and 12 more

Timeline

Published Sep 02, 2016
Tracked Since Feb 18, 2026