CVE-2026-44889: Pylons WebOb open redirect in HTTP Location header normalization

CVE-2026-44889 · Severity: medium · CVSS 6.1 · Published 2026-06-22

WebOb is a Python library used by web applications to handle HTTP requests and responses. A security flaw in how it handles web address redirects allows attackers to trick users into visiting malicious external websites. By providing a specially crafted link, an attacker can bypass security filters and redirect a user from a trusted site to an attacker-controlled one, potentially leading to phishing or malware delivery.

Technologies: webob (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44889 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44889 being exploited in the wild.
How severe is CVE-2026-44889?
Medium severity, with a CVSS score of 6.1, published 22 June 2026.
Which products and versions are affected?
webob (PyPI) <= 1.8.9, ECOSYSTEM:introduced=0,fixed=1.8.10.
Is there a fix for CVE-2026-44889?
Yes. webob (PyPI): upgrade to 1.8.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44889 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44889?
Check whether you run webob (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • webob (PyPI): upgrade to 1.8.10 or later
    pip install "webob>=1.8.10"

Technical details

WebOb prior to 1.8.10 is vulnerable to an open redirect (CWE-601) during HTTP Location header normalization. The library uses Python's 'urljoin' to merge redirect targets with the request URI. Since Python 3.10, 'urlsplit' (used internally by urljoin) strips ASCII tab, carriage return, and newline characters before parsing. An attacker can supply a redirect target containing these characters (e.g., '/\t/attacker.com') which, after stripping, is interpreted as a protocol-relative URL ('//attacker.com'). This bypasses the previous fix for CVE-2024-42353. Exploitation requires the attacker to influence the redirect location and for a user to interact with the crafted link. The issue is fixed in version 1.8.10.

Affected products

  • Pylons Project WebOb < 1.8.10

Identifiers

  • CVE-2026-44889
  • GHSA-fh3h-vg37-cc95
  • PYSEC-2026-251

Timeline

  • 2026-06-02: advisory: GitHub advisory published by maintainers
  • 2026-06-22: disclosed: NVD publication date
  • 2026-06-22: patched: Version 1.8.10 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.