LiveActive security incident?Get immediate response
CVE Record

CVE-2020-26137: urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrat...

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2020-26137 affects urllib3 before 1.25.9. If an application lets an attacker control the HTTP method used in an outgoing request, control characters could cause CRLF injection. Most organizations are exposed through older Python dependencies or OS packages, but practical risk depends on whether untrusted input can reach request-method handling.

Executive priority

Treat this as a targeted dependency remediation item, not an emergency. Prioritize internet-facing or multi-tenant systems that construct outbound HTTP requests from user input, then remediate remaining older urllib3 deployments through normal patch management.

Technical view

urllib3 before 1.25.9 allowed CR and LF characters in the HTTP request method passed through putrequest(). That can create request-splitting style behavior in clients that build outbound HTTP requests from attacker-controlled method strings. The cited sources identify upstream urllib3 changes and downstream Ubuntu/Debian security updates, but do not provide CVSS, CWE, or active-exploitation evidence.

Likely exposure

Exposure is most likely in Python applications, containers, or OS packages using urllib3 versions before 1.25.9, especially custom HTTP clients, proxies, API gateways, SSRF-adjacent fetchers, or integrations that accept user-selected HTTP methods.

Exploitation context

The source bundle does not show KEV listing or confirmed active exploitation. Exploitation requires attacker influence over the HTTP request method, which is a narrower condition than simply accepting user-controlled URLs or headers.

Researcher notes

The key exposure question is data flow: can attacker-controlled input become the HTTP method passed to urllib3 or lower-level request construction? Sources confirm the pre-1.25.9 issue and fixes, but do not establish affected downstream products beyond listed distribution advisories.

Mitigation direction

  • Upgrade urllib3 to 1.25.9 or later where application dependencies control the package.
  • Apply vendor OS security updates for bundled python-urllib3 packages.
  • Allowlist HTTP methods instead of accepting arbitrary user-supplied method strings.
  • Review custom HTTP client wrappers, proxy features, and request-forwarding code paths.
  • Check Ubuntu, Debian, Oracle, and upstream urllib3 guidance for environment-specific fixes.

Validation and detection

  • Inventory Python dependency manifests, lockfiles, containers, and hosts for urllib3 before 1.25.9.
  • Confirm runtime package versions match the patched dependency or OS package.
  • Search code for custom HTTP method construction and putrequest-related paths.
  • Verify untrusted users cannot supply raw HTTP method values.
  • Document accepted residual risk where legacy packages cannot be upgraded immediately.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-26137 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
9Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.