CVE-2020-11078: httplib2 - Unescaped URI Allows Header and Body Manipulation
Summary
CVE-2020-11078: In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for httplib2.Http.request() could change request headers and body, send additional hidden requests to same server. Affects httplib2 across 2 version ranges.
< 0.18.0
< a1457cc31f3206cf691d11d2bf34e98865873e9e
Fixed in a1457cc31f3206cf691d11d2bf34e98865873e9e. How to fix ↓
Also tracked for
- python-httplib2 · Debian:11
The same CVE-2020-11078 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
httplib2 is a Python library that provides a high-level interface for making HTTP requests. It is commonly used in various Python applications to handle HTTP communication. The library allows developers to construct and send HTTP requests, handle responses, and manage cookies and authentication. However, versions of httplib2 before 0.18.0 are vulnerable to an issue where an attacker controlling an unescaped part of the URI passed to httplib2.Http.request() can modify request headers and body, potentially leading to unauthorized actions or information disclosure. This vulnerability affects software that constructs URIs using string concatenation instead of proper URL encoding.
Vulnerability Detail
The vulnerability in httplib2 arises from the improper handling of unescaped parts of the URI. When constructing an HTTP request, if the URI is not properly encoded, an attacker can manipulate the request headers and body by injecting additional content. This can lead to various security issues, such as unauthorized access, data tampering, or information disclosure. The vulnerability can be exploited by an attacker who can control a portion of the URI used in the request. It is important to note that this vulnerability only affects versions of httplib2 prior to 0.18.0.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "httplib2==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
a1457cc31f3206cf691d11d2bf34e98865873e9e
This is the first release that contains the fix.
pip install --upgrade "httplib2==a1457cc31f3206cf691d11d2bf34e98865873e9e"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of httplib2 is not immediately feasible, a possible workaround is to ensure that the URI used in the request is properly encoded. Instead of manually concatenating the URI components, developers should use a URL encoding function or library to construct the URI. This ensures that any potentially malicious content is properly escaped and cannot be used to manipulate the request headers and body.
Conclusion
The vulnerability in httplib2 versions prior to 0.18.0 allows an attacker to manipulate request headers and body by controlling an unescaped part of the URI. To mitigate this issue, it is crucial to upgrade to the latest version of httplib2 (0.18.0 or later) or ensure proper URI encoding. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for httplib2 →
FAQ
httplib2 is a Python library that provides a high-level interface for making HTTP requests. It is commonly used in various Python applications to handle HTTP communication.
The vulnerability allows an attacker to manipulate request headers and body, potentially leading to unauthorized actions or information disclosure.
Versions of httplib2 prior to 0.18.0 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to httplib2 version 0.18.0 or later.
If upgrading to the latest version is not immediately feasible, developers can ensure that the URI used in the request is properly encoded to prevent unauthorized manipulation.
Related vulnerabilities
Recent vulnerabilities recorded for httplib2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
