CVE-2020-26137: urllib3 CRLF Injection Vulnerability
Summary
CVE-2020-26137: urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). Affects urllib3 across 2 version ranges.
< 1.25.9
< 1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
Fixed in 1dd69c5c5982fae7c87a620d487c2ebf7a6b436b. How to fix ↓
Also tracked for
- py3-urllib3 · Alpine:v3.13
The same CVE-2020-26137 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful HTTP client library for Python, providing a simple and intuitive API for making HTTP requests. It is widely used in various Python applications and frameworks. However, urllib3 versions before 1.25.9 are vulnerable to CRLF injection if the attacker controls the HTTP request method. This vulnerability allows an attacker to insert carriage return (CR) and line feed (LF) control characters in the first argument of the putrequest() function. This issue is similar to CVE-2020-26116.
Vulnerability Detail
The CRLF injection vulnerability in urllib3 can have serious consequences. By injecting CR and LF characters into the HTTP request method, an attacker can manipulate the headers and potentially perform various attacks, such as HTTP response splitting, cache poisoning, and cross-site scripting (XSS). This can lead to unauthorized access, data leakage, and other security breaches. It is crucial to address this vulnerability promptly to ensure the security and integrity of applications using urllib3.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
This is the first release that contains the fix.
pip install --upgrade "urllib3==1dd69c5c5982fae7c87a620d487c2ebf7a6b436b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading urllib3 is not immediately feasible, a temporary workaround is to sanitize user-controlled input before passing it to the putrequest() function. This can be done by removing any CR and LF characters from the input. Here's an example of how to sanitize the input in Python:
import urllib3
def sanitize_input(input_string):
return input_string.replace('\r', '').replace('\n', '')
http = urllib3.PoolManager()
http.putrequest(sanitize_input(user_input), ...)
Please note that this workaround is not a permanent solution and should be replaced with the recommended upgrade as soon as possible.
Conclusion
The CRLF injection vulnerability in urllib3 can have serious security implications, allowing attackers to manipulate HTTP headers and potentially perform various attacks. It is crucial to upgrade urllib3 to version 1.25.9 or later to mitigate this vulnerability. If immediate upgrade is not possible, sanitizing user-controlled input can serve as a temporary workaround. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urllib3 →
FAQ
urllib3 is a Python library that provides a high-level interface for making HTTP requests. It is commonly used in Python applications and frameworks to handle HTTP communication.
CRLF injection is a type of web vulnerability where an attacker can inject carriage return (CR) and line feed (LF) characters into HTTP headers or other parts of a request. This can lead to various attacks, such as HTTP response splitting and cache poisoning.
The CRLF injection vulnerability in urllib3 allows an attacker to manipulate HTTP headers and potentially perform attacks like HTTP response splitting, cache poisoning, and cross-site scripting (XSS). This can lead to unauthorized access, data leakage, and other security breaches.
To fix this vulnerability, you should upgrade urllib3 to version 1.25.9 or later. This version includes a fix for the CRLF injection issue. You can upgrade urllib3 by running the command 'pip install --upgrade urllib3'.
If upgrading urllib3 is not immediately feasible, you can sanitize user-controlled input before passing it to the putrequest() function. This involves removing any CR and LF characters from the input. However, this workaround is not a permanent solution and should be replaced with the recommended upgrade as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
