CVE-2020-11078mediumCWE-93

CVE-2020-11078: medium-severity vulnerability in httplib2

CRLF injection in httplib2

Published · Updated

Follow this CVE+ Monitor httplib2+ Monitor python-httplib2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 2.4%
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected products
httplib2 · httplib2
Related CVEs — httplib2

In the same product, most dangerous first.

CVE-2021-21240HIGHRegular Expression Denial of Service in httplib2EPSS 3.7%CVE-2026-59939HIGHhttplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response HandlingEPSS 0.7%