CVE-2019-11236 Improper Neutralization of CRLF Sequences in urllib3 library for Python
Attackers can inject CRLF characters into HTTP requests via urllib3, potentially leading to header injection or cache poisoning.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-11236?
CVE-2019-11236 is a medium-severity vulnerability in n/a, published on 15 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
Weakness: CWE-93
Which versions are affected by CVE-2019-11236?
3 open source packages ship an affected version, including urllib3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
urllib3 PyPI | All versions | 1.24.3 |
urllib3 PyPI | All versions | 1.24.3 |
urllib3 PyPI | All versions | 1.24.3 |
Products include Python Urllib3.
How do I fix CVE-2019-11236?
Upgrade urllib3 to 1.24.3 or later.
Is CVE-2019-11236 being exploited?
There is no known exploitation of CVE-2019-11236 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-97689 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
- CVE-2026-44432 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
- CVE-2026-21441 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
- CVE-2025-66418 urllib3 allows an unbounded number of links in the decompression chain
- CVE-2025-66471 urllib3 Streaming API improperly handles highly compressed data
Sources
Also known as DEBIAN-CVE-2019-11236, DLA-1828-1, GHSA-r64q-w8jr-g9qp, MGASA-2019-0259, MINI-9h5g-9pw6-h86c, PYSEC-2019-132 and 3 more.