Sign in
Deutsch English Español Polski
Medium

CRLF injection in urllib3

  • Disclosed: 30.09.2020
  • Updated: 11.10.2026 11:20

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) urllib3 < 1.25.9 1.25.9

References

CVSS score 6.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE)
CWE-74
Platform
Python (PyPI)
Package
urllib3
Disclosed
30.09.2020
Updated
11.10.2026 11:20

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2020-148 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-wqvq-5m8c-6g24 - CC BY 4.0

Vulnerability history: urllib3

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (22) in the archive
Total entries
22
First → latest
01.2017 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 11
  • Medium 10

Disclosures per year

Severity:
  1. urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
    High CVE-2026-97689 >= 1.10.3, < 2.8.0 2.8.0
  2. urllib3: HTTPS proxy TLS configuration may be ignored or overridden
    High CVE-2026-97687 >= 1.26.0, < 2.8.0 2.8.0
  3. urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
    High · 7.5 CVE-2026-44432 >= 2.6.0, < 2.7.0 2.7.0
  4. urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
    High · 5.3 CVE-2026-44431 >= 1.23, < 2.7.0 2.7.0
  5. Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
    High · 7.5 CVE-2026-21441 >= 1.22, < 2.6.3 2.6.3
  6. urllib3 streaming API improperly handles highly compressed data
    High CVE-2025-66471 >= 1.0, < 2.6.0 2.6.0
  7. urllib3 allows an unbounded number of links in the decompression chain
    High CVE-2025-66418 >= 1.24, < 2.6.0 2.6.0
  8. `Cookie` HTTP header isn't stripped on cross-origin redirects
    High · 5.9 CVE-2023-43804 >= 2.0.0, < 2.0.6, < 1.26.17 2.0.6, 1.26.17
  9. Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
    High · 7.5 CVE-2021-33503 >= 1.25.4, < 1.26.5 1.26.5
  10. CRLF injection in urllib3 this entry
    Medium · 6.5 CVE-2020-26137 < 1.25.9 1.25.9
  11. Uncontrolled Resource Consumption in urllib3
    High · 7.5 CVE-2020-7212 >= 1.25.2, < 1.25.8 1.25.8
  12. Improper Certificate Validation in urllib3
    High · 7.5 CVE-2019-11324 < 1.24.2 1.24.2
  13. Exposure of Sensitive Information to an Unauthorized Actor in urllib3
    Critical · 9.8 CVE-2018-20060 < 1.23 1.23

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.