Vulnerability DatabaseCVE-2025-15282
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2025-15282
Published:January 20, 2026
Updated:August 06, 2026
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
Related Resources (9)
https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38
https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f
https://github.com/python/cpython/pull/143926
https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80
https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0
https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a
https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/
https://github.com/python/cpython/issues/143925
https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47
Do you need more information?
Contact Us
CVSS v4
Base Score:
6
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
LOW
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.7
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE
Weakness Type (CWE)
Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-93
EPSS
Base Score:
0.48