CVE-2020-7695

Published: Jul 27, 2020Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

Affected (1)

Products: Encode: Uvicorn

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Encode Uvicorn	Before 0.11.7

Related CWEs

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (4)

https://github.com/encode/uvicorn

Source: report@snyk.io

Third Party Advisory

https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471

Source: report@snyk.io

ExploitThird Party Advisory

https://github.com/encode/uvicorn

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.