HighFix available
pypy3 — security advisory
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
- Products
- pypy3
- Affected versions
- Not specified
- Fixed versions
- 7.3.3+dfsg-1
- CVEs
- CVE-2020-26116
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 12:27 UTC · Revision 1
Source evidence
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
osv:DEBIAN-CVE-2020-26116
pypy3
Fixed versions: 7.3.3+dfsg-1
pypy3
Fixed versions: 7.3.3+dfsg-1
pypy3
Fixed versions: 7.3.3+dfsg-1
Complete source record
{
"id": "d26145a28fde1b3e978761f86e17011c4f9308855456895309b8553ed4164535",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-26116",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2020-26116",
"summary": "http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.",
"evidence": "osv:DEBIAN-CVE-2020-26116",
"products": [
{
"name": {
"value": "pypy3",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.3.3+dfsg-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pypy3",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.3.3+dfsg-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pypy3",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.3.3+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2020-26116",
"aliases": [
"DEBIAN-CVE-2020-26116"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.3.3+dfsg-1"
}
]
}
],
"package": {
"name": "pypy3",
"purl": "pkg:deb/debian/pypy3?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-26116.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.3.3+dfsg-1"
}
]
}
],
"package": {
"name": "pypy3",
"purl": "pkg:deb/debian/pypy3?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-26116.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.3.3+dfsg-1"
}
]
}
],
"package": {
"name": "pypy3",
"purl": "pkg:deb/debian/pypy3?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-26116.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T12:00:10.743214231Z",
"provider": "osv",
"upstream": [
"CVE-2020-26116"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2020-26116"
]
},
"related_cves": [
{
"value": "CVE-2020-26116",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 451010,
"published_at": "2020-09-27T04:15:11.587+00:00"
}