HTTP response splitting in uvicorn
Priority LOW 27CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Why it matters now
EPSS 0.01386 72nd percentileScored 2026-11-07
Fix Fixed uvicorn (PyPI): 0.11.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | uvicorn | all versions | — | No fix listed | CNA |
| — | uvicorn (PyPI) | before 0.11.7 | 0.11.7 | Patch available | GHSA-f97h-2pfx-f59f |
- uvicorn Vendor— Affected all versions Fixed in — No fix listed CNA
- uvicorn (PyPI) Vendor— Affected before 0.11.7 Fixed in 0.11.7 Patch available GHSA-f97h-2pfx-f59f
Remediation
- Fix · GHSA-f97h-2pfx-f59f uvicorn (PyPI) Fixed in 0.11.7 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
uvicorn unspecified
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-06214 Log injection in uvicornPriority LOW 36
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7695
- 2026-10-03 Alias added: GHSA-f97h-2pfx-f59f
References
More encode Uvicorn vulnerabilities
- TI-2020-06214 Log injection in uvicorn CVSS 3.1HIGH 7.5
Sources
- CVE-2020-7695 · CVE Program
- CVE-2020-7695 · NVD
- FIRST EPSS
- GHSA-f97h-2pfx-f59f · GitHub Advisory Database · CC BY 4.0
- CVE-2020-7695 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences