{"id":"CVE-2020-26137","aliases":["GHSA-wqvq-5m8c-6g24","PYSEC-2020-148"],"url":"https://o3.security/vulnerability/CVE-2020-26137","summary":"CRLF injection in urllib3","details":"urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.","published":"2020-09-30T18:15:26.773Z","modified":"2026-08-07T11:48:28.065328855Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"urllib3","fixedVersion":"1.25.9"}],"fix":{"url":"https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b","label":"urllib3/urllib3@1dd69c5"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4570-1/"},{"type":"REPORT","url":"https://bugs.python.org/issue39603"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/pull/1800"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:48:28.065328855Z"}}