Medium USN-4570-1 1 CVE

python-urllib3 vulnerability

Published Oct 5, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that urllib3 incorrectly handled certain character
sequences. A remote attacker could possibly use this issue to perform CRLF
injection.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	python-urllib3	1.13.1-2ubuntu0.16.04.4
Ubuntu · 18.04 LTS 18.04:LTS	python-urllib3	1.22-1ubuntu0.18.04.2
Ubuntu · 20.04 LTS 20.04:LTS	python-urllib3	1.25.8-2ubuntu0.1

Vulnerabilities 1

Medium 6.5

CVE-2020-26137

CRLF injection in urllib3

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

python-pip urllib3 python-urllib3 python-urllib3 Debian Ubuntu Alpine PyPI

Sep 29, 2020

References

report
https://ubuntu.com/security/CVE-2020-26137