Skip to content
OpenAdvisories
Medium DLA-761-1 1 CVE

python-bottle - security update

Published Dec 24, 2016 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 7 python-bottle 0.10.11-1+deb7u2

Vulnerabilities 1

  • Medium 6.5
    CVE-2016-9964

    bottle.py vulnerable to CRLF Injection

    redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

    bottle python-bottle python-bottle Debian Ubuntu PyPI