CVE-2019-18348
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk89th percentile - higher than 89% of all known CVEs
Summary
In urllib2 (Python 2.x through 2.7.17) and urllib (Python 3.x through 3.8.0), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the host component of a URL followed by an HTTP header. This is similar to CVE-2019-9740 and CVE-2019-9947 and is fixed in later Python versions.
Risk Assessment
An attacker can inject arbitrary HTTP headers, potentially leading to response splitting or other attacks. The risk affects applications processing untrusted URLs.
Recommendation
Upgrade Python to a fixed version (e.g., 2.7.18+, 3.5.10+, 3.6.11+, 3.7.8+, 3.8.3+ or later) and validate and sanitize URL-derived input.
Other vulnerabilities in Python urllib
See all- CVE-2019-9947Medium
In urllib2 (Python 2.x through 2.7.16) and urllib (Python 3.x through 3.7.3), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the path component of a URL that lacks a ? character, followed by an HTTP header or a Redis command. This is similar to CVE-2019-9740 and is fixed in later Python versions.
- CVE-2019-9740Medium
In urllib2 (Python 2.x through 2.7.16) and urllib (Python 3.x through 3.7.3), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the query string (after a ? character) followed by an HTTP header or a Redis command. The issue is fixed in later Python versions.
- CVE-2026-15806Medium
The HTTPPasswordMgr class in the urllib.request module and its subclasses did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for https:// were also used for http:// requests, allowing cleartext capture.
Original NVD description (English source)
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS