{"action":"Upgrade pypy3 to 7.3.3+dfsg-1 or later.","affected":[{"fixed":"7.3.3+dfsg-1","introduced":"0"}],"component":"pypy3","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["7.3.3+dfsg-1"],"id":"tcs_01M5NEWX71P7MH50E068SZWANS","modified_at":"2026-10-26T12:00:10.743214231Z","published_at":"2020-09-27T04:15:11.587Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2020-26116","https://security-tracker.debian.org/tracker/CVE-2020-26116"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2020-26116","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2020-26116"}],"summary":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inse"}