VULNERABILITY INTELLIGENCE

CVE-2025-15282

EPSS probability0.54%
CISA KEVNot currently listed
Published2026-01-20
Last modified2026-06-17

Description

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

Weakness classification

  • cna@python.org: CWE-93

Primary references