CVE-2025-15282
MediumCVSS 6.0Summary
The urllib.request.DataHandler module in Python parses user-controlled data URLs, allowing header injection through newlines in the data URL mediatype.
Risk Assessment
This can lead to HTTP header injection, potentially enabling request smuggling attacks or bypassing security mechanisms in applications that process untrusted URLs.
Recommendation
Update Python to a patched version or avoid processing untrusted data URLs with urllib.request.DataHandler.
Other vulnerabilities in Python urllib
See all- CVE-2019-9947Medium
In urllib2 (Python 2.x through 2.7.16) and urllib (Python 3.x through 3.7.3), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the path component of a URL that lacks a ? character, followed by an HTTP header or a Redis command. This is similar to CVE-2019-9740 and is fixed in later Python versions.
- CVE-2019-9740Medium
In urllib2 (Python 2.x through 2.7.16) and urllib (Python 3.x through 3.7.3), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the query string (after a ? character) followed by an HTTP header or a Redis command. The issue is fixed in later Python versions.
- CVE-2026-15806Medium
The HTTPPasswordMgr class in the urllib.request module and its subclasses did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for https:// were also used for http:// requests, allowing cleartext capture.
- CVE-2019-18348Medium
In urllib2 (Python 2.x through 2.7.17) and urllib (Python 3.x through 3.8.0), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the host component of a URL followed by an HTTP header. This is similar to CVE-2019-9740 and CVE-2019-9947 and is fixed in later Python versions.
Original NVD description (English source)
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS