DEBIAN-CVE-2020-26116
- Source
- https://security-tracker.debian.org/tracker/CVE-2020-26116
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2020-26116.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2020-26116
- Upstream
- Downstream
- Published
- 2020-09-27T04:15:11Z
- Modified
- 2026-09-01T16:05:00Z
- Severity
-
- 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
- References
Affected packages
Debian:12 / pypy3
Package
- Name
- pypy3
- Purl
- pkg:deb/debian/pypy3?arch=source&distro=bookworm
Debian:13 / pypy3
Package
- Name
- pypy3
- Purl
- pkg:deb/debian/pypy3?arch=source&distro=trixie
Debian:14 / pypy3
Package
- Name
- pypy3
- Purl
- pkg:deb/debian/pypy3?arch=source&distro=forky