CVE-2020-26116
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP reques…
Published Sep 27, 2020 · updated Oct 14, 2026 · python python
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
Timeline
Detection, updates, and resolution for this record.
Sep 27, 2020 · NIST NVD
Detected
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
Oct 14, 2026 · NIST NVD
Updated
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
Affected
- cpe canonical/ubuntu linux12.04
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora31
- cpe fedoraproject/fedora32
- cpe fedoraproject/fedora33
- cpe netapp/solidfireversion unspecified
- cpe opensuse/leap15.1
- cpe oracle/zfs storage appliance kit8.8
- cpe python/pythonversion unspecified
Sources
- CVE.orgCVE-2020-26116
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-26116
30-day exploitation probability 6.4%
first.org - NIST NVDCVE-2020-26116
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.reque
nvd.nist.gov