Description
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
Exploits (2)
References (19)
Scores
CVSS v3
6.1
EPSS
0.4171
EPSS Percentile
97.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-113
Status
published
Products (27)
python/python
3.0
python/python
3.0.1
python/python
3.1.0
python/python
3.1.1
python/python
3.1.2
python/python
3.1.3
python/python
3.1.4
python/python
3.1.5
python/python
3.2.0
python/python
3.2.1
... and 17 more
Published
Sep 02, 2016
Tracked Since
Feb 18, 2026