Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Python Software Foundation CPython 3.10.20, 3.11.15 and 4 more versions Clear all filters
TI-2026-00465 CVE-2026-0672 · GHSA-x85f-j5v8-5vrv

Header injection in http.cookies.Morsel

Priority LOW 27

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.0048 Published 2026-01-20 Partial fix · 3.10.20, 3.11.15 +4 CWE-93
TI-2025-13957 CVE-2025-15282 · GHSA-6rv6-r2f2-gqrc

Header injection via newlines in data URL mediatype

Priority LOW 28

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00537 Published 2026-01-20 Partial fix · 3.10.20, 3.11.15 +4 CWE-93
TI-2026-00646 CVE-2026-0865 · GHSA-5mc7-p6pj-r3f5

wsgiref.headers.Headers allows header newline injection

Priority LOW 27

User-controlled header names and values containing newlines can allow injecting HTTP headers.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00554 Published 2026-01-20 Partial fix · 3.10.20, 3.11.15 +4 CWE-74