MediumFix available
py3-urllib3 — security advisory
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
- Products
- py3-urllib3
- Affected versions
- Not specified
- Fixed versions
- 1.25.9-r0
- CVEs
- CVE-2020-26137
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 12:09 UTC · Revision 1
Source evidence
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
osv:ALPINE-CVE-2020-26137
py3-urllib3
Fixed versions: 1.25.9-r0
py3-urllib3
Fixed versions: 1.25.9-r0
py3-urllib3
Fixed versions: 1.25.9-r0
py3-urllib3
Fixed versions: 1.25.9-r0
py3-urllib3
Fixed versions: 1.25.9-r0
py3-urllib3
Fixed versions: 1.25.9-r0
py3-urllib3
Fixed versions: 1.25.9-r0
py3-urllib3
Fixed versions: 1.25.9-r0
py3-urllib3
Fixed versions: 1.25.9-r0
py3-urllib3
Fixed versions: 1.25.9-r0
py3-urllib3
Fixed versions: 1.25.9-r0
py3-urllib3
Fixed versions: 1.25.9-r0
Complete source record
{
"id": "d3fae0af37a90c87cce0068bb9d3b12bc076931adb159c952e8811c95024efec",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-26137",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2020-26137",
"summary": "urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.",
"evidence": "osv:ALPINE-CVE-2020-26137",
"products": [
{
"name": {
"value": "py3-urllib3",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.9-r0",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "py3-urllib3",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.9-r0",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "py3-urllib3",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.9-r0",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "py3-urllib3",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.9-r0",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "py3-urllib3",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.9-r0",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "py3-urllib3",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.9-r0",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "py3-urllib3",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.9-r0",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "py3-urllib3",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.9-r0",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "py3-urllib3",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.9-r0",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "py3-urllib3",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.9-r0",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "py3-urllib3",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.9-r0",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "py3-urllib3",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.25.9-r0",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "ALPINE-CVE-2020-26137",
"aliases": [
"ALPINE-CVE-2020-26137"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.9-r0"
}
]
}
],
"package": {
"name": "py3-urllib3",
"purl": "pkg:apk/alpine/py3-urllib3?arch=source",
"ecosystem": "Alpine:v3.13"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-26137.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.9-r0"
}
]
}
],
"package": {
"name": "py3-urllib3",
"purl": "pkg:apk/alpine/py3-urllib3?arch=source",
"ecosystem": "Alpine:v3.14"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-26137.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.9-r0"
}
]
}
],
"package": {
"name": "py3-urllib3",
"purl": "pkg:apk/alpine/py3-urllib3?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-26137.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.9-r0"
}
]
}
],
"package": {
"name": "py3-urllib3",
"purl": "pkg:apk/alpine/py3-urllib3?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-26137.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.9-r0"
}
]
}
],
"package": {
"name": "py3-urllib3",
"purl": "pkg:apk/alpine/py3-urllib3?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-26137.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.9-r0"
}
]
}
],
"package": {
"name": "py3-urllib3",
"purl": "pkg:apk/alpine/py3-urllib3?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-26137.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.9-r0"
}
]
}
],
"package": {
"name": "py3-urllib3",
"purl": "pkg:apk/alpine/py3-urllib3?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-26137.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.9-r0"
}
]
}
],
"package": {
"name": "py3-urllib3",
"purl": "pkg:apk/alpine/py3-urllib3?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-26137.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.9-r0"
}
]
}
],
"package": {
"name": "py3-urllib3",
"purl": "pkg:apk/alpine/py3-urllib3?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-26137.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.9-r0"
}
]
}
],
"package": {
"name": "py3-urllib3",
"purl": "pkg:apk/alpine/py3-urllib3?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-26137.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.9-r0"
}
]
}
],
"package": {
"name": "py3-urllib3",
"purl": "pkg:apk/alpine/py3-urllib3?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-26137.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.9-r0"
}
]
}
],
"package": {
"name": "py3-urllib3",
"purl": "pkg:apk/alpine/py3-urllib3?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-26137.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-26T11:17:55.159987744Z",
"provider": "osv",
"upstream": [
"CVE-2020-26137"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2020-26137"
]
},
"related_cves": [
{
"value": "CVE-2020-26137",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 450568,
"published_at": "2020-09-30T18:15:26.773+00:00"
}