VULNERABILITY INTELLIGENCE

CVE-2020-7695

CVSS score5.3 MEDIUM

EPSS probability1.39%

CISA KEVNot currently listed

Published2020-07-27

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

Weakness classification

nvd@nist.gov: CWE-74

Primary references

report@snyk.io — Third Party Advisory
report@snyk.io — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory