{"id":"CVE-2026-22779","aliases":["GHSA-6pw3-h7xf-x4gp","PYSEC-2026-1222"],"url":"https://o3.security/vulnerability/CVE-2026-22779","summary":"BlackSheep ClientSession is vulnerable to CRLF injection","details":"### Impact\nThe HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request.\nExploitation requires developers to pass unsanitized user input directly into headers.\nThe server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers.\n\n**Attack vector:** Applications using user input in HTTP client requests (method, URL, headers).\n\n### Patches\nUsers who use the HTTP Client in BlackSheep should upgrade to `2.4.6`.\n\n### Workarounds\nIf users handle headers from untrusted parties, they might reject values for header names and values that contain carriage returns.\n\n### References\nhttps://owasp.org/www-community/vulnerabilities/CRLF_Injection","published":"2026-01-14T16:49:34.202Z","modified":"2026-08-12T03:51:23.560738614Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"blacksheep","fixedVersion":"2.4.6"}],"fix":{"url":"https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12","label":"Neoteroi/BlackSheep@bd4ecb9"},"references":[{"type":"WEB","url":"https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22779.json"},{"type":"ADVISORY","url":"https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22779"},{"type":"FIX","url":"https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12"},{"type":"PACKAGE","url":"https://github.com/Neoteroi/BlackSheep"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:23.560738614Z"}}