CVE-2025-15282: Header injection via newlines in data URL mediatype
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15282?
CVE-2025-15282 is considered a moderate severity vulnerability due to its potential to allow header injection via user-controlled data URLs.
How do I fix CVE-2025-15282?
To fix CVE-2025-15282, ensure you sanitize user input that may be used in data URLs by stripping out any newline characters.
What kind of attack can CVE-2025-15282 facilitate?
CVE-2025-15282 can facilitate attacks that involve injecting malicious headers into HTTP requests through manipulated data URLs.
Which software is affected by CVE-2025-15282?
CVE-2025-15282 affects the urllib library in Python, particularly its DataHandler functionality.
Is CVE-2025-15282 still exploitable in the latest versions?
As of now, the vulnerability CVE-2025-15282 may still be exploitable if proper input validation measures are not implemented in the affected software.