CVE-2016-5699
MEDIUMCPython <2.7.10, <3.4.4 - RCE
Title source: llmDescription
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
Exploits (2)
References (19)
Scores
CVSS v3
6.1
EPSS
0.3528
EPSS Percentile
97.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Classification
CWE
CWE-113
Status
draft
Affected Products (27)
python/python
< 2.7.9
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
... and 12 more
Timeline
Published
Sep 02, 2016
Tracked Since
Feb 18, 2026