Medium severity5.3OSV Advisory· Published Jan 14, 2026· Updated Jun 17, 2026
CVE-2026-22779
CVE-2026-22779
Description
BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request. Exploitation requires developers to pass unsanitized user input directly into headers.The server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers. This vulnerability is fixed in 2.4.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
blacksheepPyPI | < 2.4.6 | 2.4.6 |
Affected products
3before-asgi, v0.2.7, v0.2.8, …+ 1 more
- (no CPE)range: before-asgi, v0.2.7, v0.2.8, …
- cpe:2.3:a:neoteroi:blacksheep:*:*:*:*:*:python:*:*range: <2.4.6
Patches
Vulnerability mechanics
References
5- github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12nvdPatchWEB
- github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gpnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-6pw3-h7xf-x4gpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-22779ghsaADVISORY
- github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.