AIKIDO-2026-499458
urllib3 is vulnerable to CRLF Injection
59
Medium Risk
This Affects:
urllib3TL;DR
When urllib3 opens an HTTP CONNECT tunnel through a proxy, it builds the tunnel request line and header bytes from the target host and header values with only latin-1 encoding and no check for embedded control characters. A host or header value containing a carriage-return/line-feed pair can be interpolated directly into the bytes written to the proxy socket. That lets externally-influenced host or header data inject additional lines into the CONNECT request the proxy receives, altering the tunnel request or smuggling extra headers past it. The fix validates the tunnel host and header names/values against RFC-conformant patterns and rejects any containing control characters before the request is built.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes externally-influenced host names or header values to urllib3 when connecting through a proxy that requires an HTTP CONNECT tunnel.
Background info
urllib3 is vulnerable to CRLF Injection in versions 2.2.3 - 2.7.0.
How to fix this
Upgrade the urllib3 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.