GHSA-r64q-w8jr-g9qp CVE-2019-11236 PYSEC-2019-132

Improper Neutralization of CRLF Sequences in urllib3 library for Python

Medium PyPI

Severity: 0.0 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): 2.07%; Chance of exploitation in the next 30 days. Higher than 81.46% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
Fix: 1.24.3; Upgrade urllib3 to this version or later

Description

In the urllib3 library through 1.24.2 for Python, CRLF injection is possible if the attacker controls the request parameter.

Affected versions

PyPI

Package	Vulnerable	Fixed in
urllib3	`< 1.24.3`	`1.24.3`
urllib3	`< 1.24.3`	`1.24.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

urllib3 PyPI → `1.24.3`

pip

pip install --upgrade "urllib3>=1.24.3"

poetry

poetry add "urllib3>=1.24.3"

uv

uv add "urllib3>=1.24.3"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: Passive
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): None
Confidentiality (subsequent systems): Low
Integrity (subsequent systems): Low
Availability (subsequent systems): None

CVSS 3.0 6.1

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

Weakness

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

How to prevent it

Implementation: Avoid using CRLF as a special sequence.
Implementation: Appropriately filter or quote CRLF sequences in user-controlled input.

References

Advisories

Packages

github.com/urllib3/urllib3

Timeline

Apr 15, 2019 Published
Nov 18, 2024 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-vxq7-64xx-v4gw urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory	High	Also affects urllib3
GHSA-gh4c-6fx4-qh6g urllib3: Chunked Deflate streaming can enter an infinite loop	Medium	Also affects urllib3
GHSA-8988-9cw3-xx77 urllib3: HTTPS proxy TLS configuration may be ignored or overridden	High	Also affects urllib3
GHSA-mf9v-mfxr-j63j urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API	High	Also affects urllib3
GHSA-qccp-gfcp-xxvc urllib3: Sensitive headers forwarded across origins in proxied low-level redirects	High	Also affects urllib3
GHSA-38jv-5279-wg99 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)	High	Also affects urllib3
GHSA-2xpw-w6gg-jr37 urllib3 streaming API improperly handles highly compressed data	High	Also affects urllib3
GHSA-gm62-xv2j-4w53 urllib3 allows an unbounded number of links in the decompression chain	High	Also affects urllib3

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor