CVE-2020-26137

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-30 · updated 2026-06-17
Weakness: CWE-74

Description

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Affected products

Canonical Ubuntu Linux: 16.04, 18.04, 20.04
Debian Linux: 9.0
Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 22.2.0
Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
urllib3: before 1.25.9 — fixed in 1.25.9

How to fix

Upgrade to a fixed version: urllib3 1.25.9. Check the vendor advisory for mitigations.

References

https://bugs.python.org/issue39603
https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
https://github.com/urllib3/urllib3/pull/1800
https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
https://usn.ubuntu.com/4570-1/
https://www.oracle.com/security-alerts/cpujul2022.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://bugs.python.org/issue39603
https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
https://github.com/urllib3/urllib3/pull/1800
https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html

Get alerted when CVE-2020-26137 or the next vulnerability affects your stack