CVE-2020-11078: CRLF injection in httplib2
Summary
CVE-2020-11078: CRLF injection in httplib2. Affects httplib2 versions < 0.18.0. Fixed in 0.18.0. How to fix ↓
Also tracked for
- python-httplib2 · Debian:11
The same CVE-2020-11078 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
httplib2 is a Python library that provides a simple and convenient way to make HTTP requests. It is commonly used in various software applications to interact with web servers. However, httplib2 is vulnerable to CRLF injection, which allows an attacker to manipulate request headers and body by controlling an unescaped part of the URI passed to the httplib2.Http.request() function. This vulnerability affects software that constructs URIs using string concatenation instead of proper URL building with escaping.
Vulnerability Detail
The CRLF injection vulnerability in httplib2 can have serious consequences. An attacker who can control the unescaped part of the URI can modify request headers and body, potentially leading to unauthorized actions or information disclosure. They can also send additional hidden requests to the same server, bypassing security measures. This vulnerability can be exploited when software constructs URIs by directly concatenating user-controlled input without proper escaping. The issue has been fixed in version 0.18.0 of httplib2, where space, CR, and LF characters are now quoted before any use. This fix should not impact valid usage of the library.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "httplib2==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.18.0
This is the first release that contains the fix.
pip install --upgrade "httplib2==0.18.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the httplib2 library is not feasible, a workaround is to create the URI using the urllib.parse functions, such as urlencode and urlunsplit. Here is an example:
import urllib.parse
user_input = " HTTP/1.1\r\ninjected: attack\r\nignore-http:"
uri = urllib.parse.urlunsplit(("https", "api.server", "/v1", urllib.parse.urlencode({"q": user_input}), ""))
http.request(uri)
By using these functions, the URI will be properly constructed with escaping, mitigating the CRLF injection vulnerability.
Conclusion
The CRLF injection vulnerability in httplib2 can have serious consequences, allowing an attacker to manipulate request headers and body. It is crucial to update the httplib2 library to version 0.18.0 or later to mitigate this vulnerability. If updating is not possible, using the urllib.parse functions to construct URIs can serve as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for httplib2 →
FAQ
The impact of this vulnerability is that an attacker can manipulate request headers and body, potentially leading to unauthorized actions or information disclosure. They can also send hidden requests to the same server, bypassing security measures.
All versions of httplib2 prior to 0.18.0 are affected by this vulnerability.
To fix this vulnerability, update the httplib2 library to version 0.18.0 or later.
Yes, if updating the httplib2 library is not feasible, you can create the URI using the urllib.parse functions to mitigate the vulnerability.
The vulnerability was discovered by Recar (https://github.com/Ciyfly) and discreetly reported.
References
Related vulnerabilities
Recent vulnerabilities recorded for httplib2.
