Security readout for executives and security teams
Plain-English summary
CVE-2026-22779 affects BlackSheep’s HTTP client, not its server-side response handling. In vulnerable versions, unsafe header handling could let user-controlled input alter outbound HTTP requests. Business urgency is moderate because exploitation depends on application code passing unsanitized user input into client request headers.
Executive priority
Prioritize patching in services that make outbound HTTP requests using BlackSheep and include user-derived header values. Treat as moderate urgency: the flaw can affect request integrity, but exploitation depends on a specific coding pattern.
Technical view
BlackSheep versions before 2.4.6 have a CWE-113 CRLF injection issue in ClientSession header handling. Missing header validation can allow request modification, such as adding headers or creating an additional HTTP request. The advisory states the server part is not affected because response headers are handled by the underlying ASGI server.
Likely exposure
Exposure is limited to applications using Neoteroi BlackSheep before 2.4.6 and its HTTP ClientSession with headers influenced by unsanitized user input. Applications not using ClientSession headers with user-controlled values are less likely to be exploitable.
Exploitation context
The CVE record says exploitation requires developers to pass unsanitized user input directly into headers. The provided sources do not report active exploitation, and the CVE is not marked as CISA KEV in the source bundle.
Researcher notes
Focus review on ClientSession header validation behavior before 2.4.6 and the fixing commit. Avoid assuming server-side impact; the advisory explicitly excludes the server component. Evidence is sufficient for affected version, condition, and fix, but not for real-world exploitation.
Mitigation direction
- Upgrade BlackSheep to version 2.4.6 or later.
- Review ClientSession header construction for user-controlled input.
- Validate or reject unsafe header values before outbound requests.
- Check vendor advisory and release notes for implementation details.
Validation and detection
- Inventory Python applications using BlackSheep.
- Identify installed BlackSheep versions below 2.4.6.
- Review code paths using ClientSession request headers.
- Confirm user input is not passed directly into headers.
- Verify deployed environments run the fixed version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-113: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22779 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gpCVE reference · x_refsource_CONFIRM
- https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12CVE reference · x_refsource_MISC
- https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.