PT-2026-3662 · Python+4 · Urllib+4

Published 2026-01-16 · Updated 2026-05-19 · CVE-2025-15282

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-15282

Description User-controlled data URLs parsed by urllib.request.DataHandler can allow injection of headers through newlines in the data URL mediatype. The issue involves the parsing of data URLs, potentially leading to manipulation of HTTP headers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-93

Related Identifiers

ALSA-2026:10950

ALSA-2026:19064

ALSA-2026:19177

BDU:2026-05133

BIT-LIBPYTHON-2025-15282

BIT-PYTHON-2025-15282

BIT-PYTHON-MIN-2025-15282

CVE-2025-15282

ECHO-C06A-D4E1-7228

OESA-2026-1458

OESA-2026-1459

OESA-2026-1460

OESA-2026-1461

OPENSUSE-SU-2026:10152-1

OPENSUSE-SU-2026:10200-1

OPENSUSE-SU-2026:10206-1

OPENSUSE-SU-2026:10221-1

OPENSUSE-SU-2026:10222-1

OPENSUSE-SU-2026:10223-1

OPENSUSE-SU-2026:20254-1

PSF-2026-2

RHSA-2026:10950

RHSA-2026:19064

RHSA-2026:19177

RHSA-2026:7443

RHSA-2026:7661

RHSA-2026:8822

RHSA-2026:8824

SUSE-SU-2026:0612-1

SUSE-SU-2026:0613-1

SUSE-SU-2026:0642-1

SUSE-SU-2026:0643-1

SUSE-SU-2026:0644-1

SUSE-SU-2026:0645-1

SUSE-SU-2026:0664-1

SUSE-SU-2026:0693-1

SUSE-SU-2026:0767-1

SUSE-SU-2026:1107-1

SUSE-SU-2026:1117-1

SUSE-SU-2026:1349-1

SUSE-SU-2026:20543-1

SUSE-SU-2026:20581-1

SUSE-SU-2026:20665-1

SUSE-SU-2026:20710-1

SUSE-SU-2026:20768-1

SUSE-SU-2026:20796-1

USN-8018-1

USN-8018-3

Affected Products

Linuxmint

Red Os

Rocky Linux

Ubuntu

Urllib

References · 181

• https://github.com/python/cpython/pull/143926 · Patch
• https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a · Patch
• https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f · Patch
• https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80 · Patch
• https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47 · Patch
• https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0 · Patch
• https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38 · Patch
• https://errata.almalinux.org/8/ALSA-2026-10950.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:19064 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-19177.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-12084 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8018-3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12781 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10206-1 · Vendor Advisory