CVE-2020-26137

Name of the Vulnerable Software and Affected Versions urllib3 versions prior to 1.25.9

Description The issue is related to insufficient neutralization of special elements in the HTTP request method, which can lead to CRLF injection if the attacker controls the HTTP request method. This can be demonstrated by inserting CR and LF control characters in the first argument of putrequest(). The exploitation of this issue may allow a remote attacker to access and compromise confidential data.

Recommendations For versions prior to 1.25.9, update to version 1.25.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of the putrequest() function to minimize the risk of exploitation.