{"action":"Upgrade urllib3 to 1.25.9 or later.","affected":[{"fixed":"1.25.9","introduced":"0"}],"component":"urllib3","cve_ids":["CVE-2020-26137"],"ecosystem":"PyPI","epss":0.02269,"exploited":false,"fixed_versions":["1.25.9"],"ghsa_id":"GHSA-wqvq-5m8c-6g24","id":"tcs_01M5KG9JK9WRSMH7GA80NT6N0A","modified_at":"2023-11-08T04:03:14.251187Z","published_at":"2020-09-30T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-148","https://bugs.python.org/issue39603","https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b","https://github.com/urllib3/urllib3/pull/1800","https://usn.ubuntu.com/4570-1/","https://github.com/advisories/GHSA-wqvq-5m8c-6g24"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-148","url":"https://osv.dev/vulnerability/PYSEC-2020-148"}],"summary":"urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: thi"}