Medium severity5.3NVD Advisory· Published Jul 27, 2020· Updated Jun 17, 2026

CVE-2020-7695

Description

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
uvicornPyPI	< 0.11.7	0.11.7

Affected products

Encode/uvicorn
cpe:2.3:a:encode:uvicorn:*:*:*:*:*:*:*:*
Range: <0.11.7
Uvicorn/Uvicorndescription
ghsa-coords
pkg:pypi/uvicorn
Range: < 0.11.7

Patches

Vulnerability mechanics

References

snyk.io/vuln/SNYK-PYTHON-UVICORN-570471nvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-f97h-2pfx-f59fghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-7695ghsaADVISORY
github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yamlghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000