CVE-2019-9947
MediumCVSS 6.1Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
In urllib2 (Python 2.x through 2.7.16) and urllib (Python 3.x through 3.7.3), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the path component of a URL that lacks a ? character, followed by an HTTP header or a Redis command. This is similar to CVE-2019-9740 and is fixed in later Python versions.
Risk Assessment
An attacker can inject arbitrary HTTP headers or Redis commands, potentially leading to response splitting or unauthorized operations. The risk affects applications processing untrusted URLs.
Recommendation
Upgrade Python to a fixed version (e.g., 2.7.17+, 3.5.10+, 3.6.10+, 3.7.4+ or later) and validate and sanitize URL-derived input.
Other vulnerabilities in Python urllib
See all- CVE-2019-9740Medium
In urllib2 (Python 2.x through 2.7.16) and urllib (Python 3.x through 3.7.3), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the query string (after a ? character) followed by an HTTP header or a Redis command. The issue is fixed in later Python versions.
- CVE-2026-15806Medium
The HTTPPasswordMgr class in the urllib.request module and its subclasses did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for https:// were also used for http:// requests, allowing cleartext capture.
- CVE-2019-18348Medium
In urllib2 (Python 2.x through 2.7.17) and urllib (Python 3.x through 3.8.0), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the host component of a URL followed by an HTTP header. This is similar to CVE-2019-9740 and CVE-2019-9947 and is fixed in later Python versions.
Original NVD description (English source)
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS