CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVE-2020-26137
Medium (6.5). EPSS 2.3% chance of exploitation in the next 30 days. Fixed in urllib3 1.25.9.
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
Severity
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-74
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- oracle:communications_cloud_native_core_network_function_cloud_native_environment
- oracle:zfs_storage_appliance_kit
- python:urllib3
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wqvq-5m8c-6g24 | PyPI | urllib3 | <1.25.9 | 1.25.9 |
| PYSEC-2020-148 | PyPI | urllib3 | <1.25.9 | 1.25.9 |