Description
Bottle before 0.12.20 mishandles errors during early request binding.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-bottle | 0.12.20-1 | — |
| Debian 13 | python-bottle | 0.12.20-1 | — |
| Debian 12 | python-bottle | 0.12.20-1 | — |
| Debian 11 | python-bottle | 0.12.19-1+deb11u1 | DSA-5159-1 |
| Debian 10 | python-bottle | 0.12.15-2+deb10u2 | DSA-5159-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | python-bottle | 0.12.13-1+deb9u2 | DLA-3048-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | python-bottle | 0.12.19-1+deb11u1build0.22.04.1 | USN-5532-1 |
| Ubuntu 20.04 LTS | python-bottle | 0.12.15-2.1ubuntu0.2 | USN-5532-1 |
| Ubuntu 18.04 LTS | python-bottle | 0.12.13-1ubuntu0.2 | USN-5532-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | python-bottle | 0.12.7-1+deb8u1ubuntu0.1~esm1 | USN-5532-2 |
| Ubuntu Pro 14.04 LTS | python-bottle | 0.12.0-1ubuntu0.1~esm3 | USN-5532-2 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SLES 15 SP3 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SLES 15 SP2 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SLES 15 SP1 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SLES 15 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 2 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SLES for SAP 15 SP2 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SLES for SAP 15 SP1 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SLES for SAP 15 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SLE HPC 15 SP2 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SLE HPC 15 SP1 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SLE HPC 15 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SUSE Manager Server 4.1 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SUSE Manager Retail Branch Server 4.1 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SUSE Manager Proxy 4.1 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SUSE Enterprise Storage 7 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| SUSE Enterprise Storage 6 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
| openSUSE Leap 15.3 | python-bottle | 0.12.13-150000.3.6.1 | SUSE-SU-2022:3103-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-bottle | 0.12.21-r0 | — |
| Alpine v3.23 | py3-bottle | 0.12.21-r0 | — |
| Alpine v3.22 | py3-bottle | 0.12.21-r0 | — |
| Alpine v3.21 | py3-bottle | 0.12.21-r0 | — |
| Alpine v3.20 | py3-bottle | 0.12.21-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | py3-bottle | 0.12.21-r0 | — |
| Alpine v3.18 | py3-bottle | 0.12.21-r0 | — |
| Alpine v3.17 | py3-bottle | 0.12.21-r0 | — |
| Alpine v3.16 | py3-bottle | 0.12.21-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-bottle | 0.12.21-2.amzn2023.0.1 | ALAS2023-2023-082 |
| Amazon Linux 2 | python3-bottle | 0.12.21-2.amzn2 | ALAS2-2022-1844 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | bottle | < 0.12.20 | 0.12.20 | GHSA-xhp9-4947-rq78 |
Advisories 8
- USN-5532-2 python-bottle vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- DSA-5159-1 python-bottle - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3048-1 python-bottle - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-5532-1 python-bottle vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2022:3103-1 Security update for python-bottle SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2964 Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 24, 2025
- ALAS2023-2023-082 Important: python-bottle security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- ALAS2-2022-1844 Moderate: python-bottle security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 4, 2022
References
- https://github.com/bottlepy/bottle/commit/e140e1b54da721a660f2eb9d58a106b7b3ff2f00
- https://github.com/bottlepy/bottle/commit/a2b0ee6bb4ce88895429ec4aca856616244c4c4c
- https://github.com/bottlepy/bottle/compare/0.12.19...0.12.20
- [debian-lts-announce] 20220608 [SECURITY] [DLA 3048-1] python-bottle security update mailing-list
- DSA-5159 vendor-advisory
- FEDORA-2022-c1e107f37f vendor-advisory
- FEDORA-2022-cc9a173168 vendor-advisory