6
CVE-2025-15282
- EPSS 0.48%
- Veröffentlicht 20.01.2026 21:35:13
- Zuletzt bearbeitet 15.04.2026 00:35:42
- Quelle cna@python.org
- CVE-Watchlists
- Unerledigt
Header injection via newlines in data URL mediatype
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerPython Software Foundation
≫
Produkt
CPython
Default Statusunaffected
Version
0
Version <
3.10.20
Status
affected
Version
3.11.0
Version <
3.11.15
Status
affected
Version
3.12.0
Version <
3.12.13
Status
affected
Version
3.13.0
Version <
3.13.12
Status
affected
Version
3.14.0
Version <
3.14.3
Status
affected
Version
3.15.0a1
Version <
3.15.0a6
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.48% | 0.376 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| cna@python.org | 6 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
https://github.com/python/cpython/pull/143926
https://github.com/python/cpython/issues/143925
https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/
https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f
https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0
https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38
https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80
https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47
https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a