CVE-2020-26137

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.python.org/issue39603Issue Tracking, Vendor Advisory
https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436bPatch, Third Party Advisory
https://github.com/urllib3/urllib3/pull/1800Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00015.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
https://usn.ubuntu.com/4570-1/Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
https://bugs.python.org/issue39603Issue Tracking, Vendor Advisory
https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436bPatch, Third Party Advisory
https://github.com/urllib3/urllib3/pull/1800Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00015.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
https://usn.ubuntu.com/4570-1/Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Timeline

Published: Sep 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-261385.3In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.CVE-2020-261395.3An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has CVE-2020-26146.0Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: APM Mesh). Supported versions CVE-2020-261406.5An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintex CVE-2020-261416.5An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integri CVE-2020-261425.3An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. A CVE-2020-261436.5An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and WPA3 implementations accept fragme CVE-2020-261446.5An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frame CVE-2020-261456.5An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent)CVE-2020-261465.3An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-cons CVE-2020-261475.4An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of the CVE-2020-261487.5md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial of service (e.g., as