VYPR
← All advisories
Moderate severityOSV Advisory· Published Apr 15, 2019· Updated Aug 4, 2024

CVE-2019-11236

CVE-2019-11236

Description

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CRLF injection vulnerability in urllib3 for Python up to 1.24.1 allows request parameter-based injection.

Vulnerability

Overview

CVE-2019-11236 is a CRLF injection vulnerability in the urllib3 library for Python, affecting versions through 1.24.1. The vulnerability occurs when an attacker controls the request parameter, allowing injection of carriage return and line feed characters into HTTP headers or the request body [4]. This issue stems from insufficient sanitization of user-supplied input in request parameters.

Attack

Vector and Exploitation

The attack vector requires the attacker to control the request parameter, which is typically possible through user input fields or API parameters. No authentication is needed if the application directly uses unsanitized user input. The vulnerability exists in the way urllib3 handles CRLF sequences, enabling an attacker to inject additional headers or modify the request structure. Exploitation can be achieved without special network access if the application processes attacker-controlled parameters.

Impact

Successful exploitation could lead to HTTP request smuggling, header injection, or response splitting. An attacker may inject malicious headers, bypass security controls, or manipulate the request in a way that compromises the integrity of HTTP communications. This can result in cross-site scripting (XSS) or cache poisoning in downstream systems. The impact is limited to HTTP-based applications that use vulnerable urllib3 versions.

Mitigation

The vulnerability is fixed in urllib3 version 1.24.2 and later [2]. Red Hat has released patches for Red Hat Enterprise Linux 8 via RHSA-2019:3590, updating python-urllib3 to version 1.24.2-2 [2]. Other advisories, such as RHSA-2019:3335 and RHSA-2019:2272, reference related package updates [1][3]. Users should upgrade to the latest version to mitigate the risk.

References
  1. https://access.redhat.com/errata/RHSA-2019:3335
  2. https://access.redhat.com/errata/RHSA-2019:3590
  3. https://access.redhat.com/errata/RHSA-2019:2272
  4. NVD - CVE-2019-11236

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
urllib3PyPI
< 1.24.31.24.3

Affected products

160

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

24

News mentions

0

No linked articles in our index yet.