CVE-2020-26116

HighCVSS 7.2/10Last modified Oct 14, 2026

Description

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Sep 27, 2020
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-261178.1In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the ce CVE-2020-261188.8In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deseriali CVE-2020-26126.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Suppor CVE-2020-261206.1XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacem CVE-2020-261217.5An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page i CVE-2020-261227.2Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges. The Baseboard Managemen CVE-2020-261248.8openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.CVE-2020-261296.5In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.CVE-2020-26136.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Global EM Framework). Supported versi CVE-2020-261307.8Issues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1.66. Due to insufficient access restrictions CVE-2020-261317.8Issues were discovered in Open DHCP Server (Regular) 1.75 and Open DHCP Server (LDAP Based) 0.1Beta. Due to insufficient access restrictions CVE-2020-261327.8An issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the default installation directory, an attacker