PT-2026-2925 · Unknown · Blacksheep

Tr4Ce-Ju · Published 2026-01-14 · Updated 2026-01-15 · CVE-2026-22779

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions BlackSheep versions prior to 2.4.6

Description BlackSheep, an asynchronous web framework for building event-based web applications with Python, has an issue in its HTTP Client implementation. Missing validation of headers allows an attacker to modify HTTP requests, potentially inserting new headers or creating entirely new requests. Exploitation requires passing unsanitized user input directly into headers. The server component is not affected as BlackSheep relies on an underlying ASGI server for handling response headers. The attack vector involves applications using user input in HTTP client requests related to the method, URL, or headers.

Recommendations Upgrade to version 2.4.6. If handling headers from untrusted sources, reject values for header names and values that contain carriage returns.

Exploit

Fix

Weakness Enumeration

CWE-93

CWE-113

Related Identifiers

CVE-2026-22779

GHSA-6PW3-H7XF-X4GP

Affected Products

Blacksheep

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22779.json · Exploit
• https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12 · Patch
• https://osv.dev/vulnerability/CVE-2026-22779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22779 · Security Note
• https://osv.dev/vulnerability/GHSA-6pw3-h7xf-x4gp · Vendor Advisory
• https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gp · Note
• https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6 · Note
• https://github.com/Neoteroi/BlackSheep · Note
• https://twitter.com/CVEnew/status/2011555164877177040 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2011667038612197476 · Twitter Post