CVE-2019-11236: urllib3 CRLF Injection Vulnerability
Summary
CVE-2019-11236: In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. Affects urllib3 versions < 1.24.3. Fixed in 1.24.3. How to fix ↓
Also tracked for
- python-urllib3 · Debian:11
The same CVE-2019-11236 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful HTTP client library for Python that provides a simple and intuitive interface for making HTTP requests. It is widely used in various Python applications and frameworks. However, versions up to 1.24.1 are vulnerable to CRLF injection attacks if the attacker has control over the request parameter. This vulnerability allows an attacker to inject arbitrary headers or manipulate the request/response in a way that can lead to security issues.
Vulnerability Detail
The CRLF injection vulnerability in urllib3 arises due to improper handling of user-controlled input. An attacker can exploit this vulnerability by injecting CRLF characters (%0D%0A) into the request parameter. This can result in various attacks, such as HTTP response splitting, cache poisoning, session hijacking, or cross-site scripting (XSS). The impact of this vulnerability depends on the specific usage of urllib3 in the affected application.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.24.3
This is the first release that contains the fix.
pip install --upgrade "urllib3==1.24.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading urllib3 is not immediately feasible, a temporary workaround is to sanitize user-controlled input before passing it to urllib3. This can be done by removing any CRLF characters from the request parameter. Here is an example of how to sanitize the input in Python:
import urllib.parse
request_param = urllib.parse.quote(request_param, safe='')
Conclusion
The urllib3 CRLF injection vulnerability (CVE-2019-11236) allows an attacker to manipulate HTTP requests and potentially exploit various security issues. It is crucial to upgrade urllib3 to version 1.24.3 or later to mitigate this vulnerability. If immediate upgrade is not possible, sanitizing user-controlled input can serve as a temporary workaround. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urllib3 →
FAQ
urllib3 is a Python library that provides a high-level interface for making HTTP requests. It is commonly used in Python applications and frameworks.
CRLF injection is a web application vulnerability that allows an attacker to inject CRLF characters (%0D%0A) into HTTP headers or other parts of the request/response. This can lead to various security issues.
The consequences of this vulnerability depend on the specific usage of urllib3 in the affected application. Possible consequences include HTTP response splitting, cache poisoning, session hijacking, or cross-site scripting (XSS).
To fix this vulnerability, you should upgrade urllib3 to version 1.24.3 or later. This version includes a fix for the CRLF injection issue.
If upgrading urllib3 is not immediately feasible, you can sanitize user-controlled input by removing any CRLF characters from the request parameter.
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
