CVE-2023-24329

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

20% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)

CWE

CWE-20

Published

2023-02-17

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• fedoraproject:fedora
• netapp:active_iq_unified_manager
• netapp:management_services_for_element_software
• netapp:management_services_for_netapp_hci
• netapp:ontap_select_deploy_administration_utility
• python:python

References

• https://github.com/python/cpython/issues/102153
• https://github.com/python/cpython/pull/99421
• https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/

Check your stackJSON