CVE-2022-0391
HighSummary
A flaw was found in Python's urllib.parse module where the urlparse method does not sanitize input, allowing characters like ' ' and ' ' in the URL path. This can lead to CRLF injection attacks.
Risk Assessment
An attacker can exploit this vulnerability to inject malicious HTTP headers or manipulate server responses, potentially leading to session hijacking, user redirection, or other injection attacks.
Recommendation
Update Python to a patched version (e.g., Python 3.10.3 or later) immediately. As a workaround, manually sanitize input before passing it to urlparse.
Other vulnerabilities in Python
See all- CVE-2013-7338High
Python versions before 3.3.4 RC1 allow remote attackers to cause a denial of service via a file size value larger than the size of the zip file in functions related to reading and extracting zip files.
- CVE-2022-42919High
A vulnerability in Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The multiprocessing library with the forkserver start method permits pickle deserialization from any user on the same local network of the machine.
- CVE-2023-24329High
A vulnerability in the urllib.parse component of Python before version 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
- CVE-2026-1299Medium
The email module in Python, specifically the BytesGenerator class, improperly quotes newlines in email headers during serialization, allowing header injection. This only affects usage of LiteralHeader that does not respect email folding.
- CVE-2023-27043Medium
The email module in Python through 3.11.3 incorrectly parses email addresses containing special characters. The wrong portion of an RFC2822 header is identified as the value of the addr-spec.
- CVE-2026-15310Low
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
- CVE-2026-17084Medium
The 'stringprep' module did not process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This causes mismatches when processing domain names using IDNA 2003 (the 'idna' codec) and the in_table_b2() function of the 'stringprep' module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
- CVE-2026-18503Low
A vulnerability in Python's csv.Sniffer where attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing, consuming significant CPU.
- CVE-2026-15308High
The incremental HTML parser (html.parser.HTMLParser) allows CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
- CVE-2026-12003Medium
CVE-2026-12003 vulnerability concerns how Python handles the VPATH variable during builds from the source tree. On Windows, VPATH may point to a location outside the Python installation directory, potentially allowing low-privilege users to create files that could be used to access an alternative `Lib` folder.
Original NVD description (English source)
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an at