Medium severity6.1NVD Advisory· Published Sep 2, 2016· Updated Jun 17, 2026

CVE-2016-5699

Description

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Python (programming language)/Python28 versions
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*+ 27 more
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:*range: <=2.7.9
- cpe:2.3:a:python:python:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.4.3:*:*:*:*:*:*:*
- (no CPE)range: <2.7.10, <3.4.4
osv-coords60 versions
pkg:rpm/opensuse/python36&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/python3-base&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/python3&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/python-base&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/python&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/python-doc&distro=openSUSE%20Tumbleweed pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP1 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1 pkg:rpm/suse/python3-base&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2 pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1 pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1 pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1 pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2 pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/python3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1 pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1 pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%202%2015%20SP1 pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1 pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1 pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP1 pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1 pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1 pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP1 pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%202%2015%20SP1 pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1 pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/suse/python-doc&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/python-doc&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1 pkg:rpm/suse/python-doc&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/python-doc&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/python-doc&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/python-doc&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4
< 3.6.15-1.1+ 59 more
- (no CPE)range: < 3.6.15-1.1
- (no CPE)range: < 3.6.10-lp151.6.7.1
- (no CPE)range: < 3.6.10-lp151.6.7.1
- (no CPE)range: < 2.7.12-1.4
- (no CPE)range: < 2.7.12-1.5
- (no CPE)range: < 2.7.12-1.3
- (no CPE)range: < 3.4.5-17.1
- (no CPE)range: < 3.4.5-19.1
- (no CPE)range: < 3.6.10-3.42.2
- (no CPE)range: < 3.6.10-3.42.2
- (no CPE)range: < 3.6.10-3.42.2
- (no CPE)range: < 3.6.10-3.42.2
- (no CPE)range: < 3.4.5-17.1
- (no CPE)range: < 3.4.5-17.1
- (no CPE)range: < 3.4.5-19.1
- (no CPE)range: < 3.4.5-19.1
- (no CPE)range: < 3.4.5-17.1
- (no CPE)range: < 3.4.5-19.1
- (no CPE)range: < 3.4.5-17.1
- (no CPE)range: < 3.4.5-19.1
- (no CPE)range: < 3.4.5-17.1
- (no CPE)range: < 3.4.5-19.1
- (no CPE)range: < 3.6.10-3.42.2
- (no CPE)range: < 3.6.10-3.42.2
- (no CPE)range: < 3.4.5-17.1
- (no CPE)range: < 3.4.5-17.1
- (no CPE)range: < 3.4.5-19.1
- (no CPE)range: < 3.4.5-19.1
- (no CPE)range: < 3.4.5-17.1
- (no CPE)range: < 3.4.5-19.1
- (no CPE)range: < 2.7.9-24.2
- (no CPE)range: < 2.7.17-7.32.1
- (no CPE)range: < 2.7.17-7.32.1
- (no CPE)range: < 2.7.17-7.32.1
- (no CPE)range: < 2.6.9-39.1
- (no CPE)range: < 2.7.9-24.2
- (no CPE)range: < 2.7.9-16.7.2
- (no CPE)range: < 2.6.9-39.1
- (no CPE)range: < 2.7.9-24.2
- (no CPE)range: < 2.6.9-39.1
- (no CPE)range: < 2.7.9-24.2
- (no CPE)range: < 2.7.9-24.2
- (no CPE)range: < 2.7.9-24.1
- (no CPE)range: < 2.7.17-7.32.2
- (no CPE)range: < 2.7.17-7.32.2
- (no CPE)range: < 2.7.17-7.32.2
- (no CPE)range: < 2.7.17-7.32.2
- (no CPE)range: < 2.7.17-7.32.2
- (no CPE)range: < 2.6.9-39.1
- (no CPE)range: < 2.7.9-24.1
- (no CPE)range: < 2.7.9-16.7.1
- (no CPE)range: < 2.6.9-39.1
- (no CPE)range: < 2.7.9-24.1
- (no CPE)range: < 2.6.9-39.1
- (no CPE)range: < 2.6-8.39.1
- (no CPE)range: < 2.7.9-24.4
- (no CPE)range: < 2.7.9-16.7.2
- (no CPE)range: < 2.6-8.39.1
- (no CPE)range: < 2.7.9-24.4
- (no CPE)range: < 2.6-8.39.1

Patches

Vulnerability mechanics

References

hg.python.org/cpython/rev/1c45047c5102nvdPatch
hg.python.org/cpython/rev/bf3e1c9b80e9nvdPatch
blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.htmlnvdExploitThird Party Advisory
www.openwall.com/lists/oss-security/2016/06/14/7nvdMailing List
www.openwall.com/lists/oss-security/2016/06/15/12nvdMailing List
www.openwall.com/lists/oss-security/2016/06/16/2nvdMailing List
docs.python.org/3.4/whatsnew/changelog.htmlnvdRelease Notes
hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWSnvdRelease Notes
lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlnvd
rhn.redhat.com/errata/RHSA-2016-1626.htmlnvd
rhn.redhat.com/errata/RHSA-2016-1627.htmlnvd
rhn.redhat.com/errata/RHSA-2016-1628.htmlnvd
rhn.redhat.com/errata/RHSA-2016-1629.htmlnvd
rhn.redhat.com/errata/RHSA-2016-1630.htmlnvd
www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlnvd
www.securityfocus.com/bid/91226nvd
www.splunk.com/view/SP-CAAAPSVnvd
www.splunk.com/view/SP-CAAAPUEnvd
lists.debian.org/debian-lts-announce/2019/02/msg00011.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.008
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000