PyPI/webob CVE-2026-44889: medium 6.1, EPSS 0.27%

WebOb: Location header normalization during redirect leads to open redirect - again

Action: Upgrade webob to 1.8.10 or later.

pip install webob==1.8.10

Affected

Fixed versions

Sources

• osv: GHSA-fh3h-vg37-cc95
• https://github.com/Pylons/webob/security/advisories/GHSA-fh3h-vg37-cc95
• https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3
• https://nvd.nist.gov/vuln/detail/CVE-2026-44889
• https://github.com/Pylons/webob/commit/1f681a4f17fc10777ef861e8b43ecb26053bc539
• https://github.com/Pylons/webob/commit/2b9fbedafb31180c910cf8526e9ea72b4603d0bc
• https://github.com/Pylons/webob
• https://github.com/Pylons/webob/releases/tag/1.8.10
• https://github.com/pypa/advisory-database/tree/main/vulns/webob/PYSEC-2026-251.yaml

CVE-2026-44889 · published 2026-06-04T14:33:35Z · modified 2026-09-10T03:50:49.442249208Z · JSON