BlackSheep's ClientSession is vulnerable to CRLF injection
Impact
The HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request. Exploitation requires developers to pass unsanitized user input directly into headers. The server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers.
Attack vector: Applications using user input in HTTP client requests (method, URL, headers).
Patches
Users who use the HTTP Client in BlackSheep should upgrade to 2.4.6.
Workarounds
If users handle headers from untrusted parties, they might reject values for header names and values that contain carriage returns.
References
https://owasp.org/www-community/vulnerabilities/CRLF_Injection
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | blacksheep | < 2.4.6 | 2.4.6 |
Referencias
- https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gp
- https://nvd.nist.gov/vuln/detail/CVE-2026-22779
- https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12
- https://github.com/Neoteroi/BlackSheep
- https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6
- https://pypi.org/project/blacksheep
- https://github.com/advisories/GHSA-6pw3-h7xf-x4gp
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N- Debilidad (CWE)
CWE-113, CWE-93- Plataforma
- Python (PyPI)
- Paquete
blacksheep- Publicada
- 14.01.2026
- Actualizado
- 11.10.2026 13:19
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-1222 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-6pw3-h7xf-x4gp - CC BY 4.0
Historial de vulnerabilidades: blacksheep
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.