CVE-2020-7695: HTTP Response Splitting
First published: Mon Jul 27 2020(Updated: )
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Credit: report@snyk.io report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Encode Uvicorn | <0.11.7 | |
| pip/uvicorn | <0.11.7 | 0.11.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-7695?
CVE-2020-7695 is a vulnerability in Uvicorn before 0.11.7 that allows for HTTP response splitting.
How can an attacker exploit CVE-2020-7695?
Attackers can exploit CVE-2020-7695 by using crafted input to add arbitrary headers to HTTP responses or return arbitrary response bodies.
What is the severity of CVE-2020-7695?
CVE-2020-7695 has a severity score of 5.3 (medium).
Which software versions are affected by CVE-2020-7695?
Uvicorn versions up to and excluding 0.11.7 are affected by CVE-2020-7695.
How can I fix CVE-2020-7695?
To fix CVE-2020-7695, update Uvicorn to version 0.11.7 or later.
- collector/nvd-index
- agent/type
- agent/title
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-f97h-2pfx-f59f
- alias/CVE-2020-7695
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/event
- agent/description
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/encode
- canonical/encode uvicorn
- package-manager/pip