Executive brief
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
Affected products
- PyPI urllib3
Junglewise Threat Intelligence
CVE-2019-11236: PYSEC-2019-132 - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
CVE-2019-11236 · Severity: low · CVSS 3 · Published 2019-04-15
Technologies: urllib3 (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1997 - urllib3 does not control redirects in browsers and Node.js
- PYSEC-2026-1999 - urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
- PYSEC-2026-1995 - urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
- urllib3 resource exhaustion via improper handling of compressed data
- urllib3 sensitive header leak in ProxyManager low-level redirects