AIKIDO-2026-193495
urllib3 is vulnerable to CRLF Injection
59
Medium Risk
This Affects:
urllib3TL;DR
HTTPConnection.getresponse() built the exposed header dictionary directly from the raw http.client message items without normalizing obsolete folded header continuation lines (obs-fold, a CRLF followed by whitespace) into a single value. A server that returns a folded header can embed literal \r\n sequences inside a header value such as Set-Cookie, and code that reads that header value receives the raw CRLF still embedded in it. Code that splits, logs, or forwards that header value can misinterpret the embedded CRLF as an additional header or cookie boundary. The fix collapses obsolete header folding into a single space before exposing header values, matching RFC 9112.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the code you call reads response header values, such as Set-Cookie, that originate from an untrusted or malicious server.
Background info
urllib3 is vulnerable to CRLF Injection in versions 0.3 - 2.7.0.
How to fix this
Upgrade the urllib3 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.