CVE-2016-5699

6.1 mediumEPSS 9.9%

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 9.9% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE: CWE-113
Published: 2016-09-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

python:python

References

http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
http://rhn.redhat.com/errata/RHSA-2016-1626.html
http://rhn.redhat.com/errata/RHSA-2016-1627.html
http://rhn.redhat.com/errata/RHSA-2016-1628.html

Check your stack JSON