CVE-2026-22779

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22779", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T18:27:19.388Z", "datePublished": "2026-01-14T16:49:34.202Z", "dateUpdated": "2026-01-14T21:01:52.743Z"}, "containers": {"cna": {"title": "BlackSheep ClientSession is vulnerable to CRLF injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-113", "lang": "en", "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gp"}, {"name": "https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12", "tags": ["x_refsource_MISC"], "url": "https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12"}, {"name": "https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6"}], "affected": [{"vendor": "Neoteroi", "product": "BlackSheep", "versions": [{"version": "< 2.4.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-14T16:49:34.202Z"}, "descriptions": [{"lang": "en", "value": "BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request. Exploitation requires developers to pass unsanitized user input directly into headers.The server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers. This vulnerability is fixed in 2.4.6."}], "source": {"advisory": "GHSA-6pw3-h7xf-x4gp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-14T21:01:45.365112Z", "id": "CVE-2026-22779", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T21:01:52.743Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22779", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T21:01:45.365112Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T21:01:50.131Z"}}], "cna": {"title": "BlackSheep ClientSession is vulnerable to CRLF injection", "source": {"advisory": "GHSA-6pw3-h7xf-x4gp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "Neoteroi", "product": "BlackSheep", "versions": [{"status": "affected", "version": "< 2.4.6"}]}], "references": [{"url": "https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gp", "name": "https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12", "name": "https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6", "name": "https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request. Exploitation requires developers to pass unsanitized user input directly into headers.The server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers. This vulnerability is fixed in 2.4.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-113", "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-14T16:49:34.202Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22779", "state": "PUBLISHED", "dateUpdated": "2026-01-14T21:01:52.743Z", "dateReserved": "2026-01-09T18:27:19.388Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-14T16:49:34.202Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "BlackSheep", "vendor": "Neoteroi", "versions": [{"status": "affected", "version": "< 2.4.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:neoteroi:blacksheep:*:*:*:*:*:python:*:*", "matchCriteriaId": "FD85CB64-1BE0-413B-A144-357F606AD016", "versionEndExcluding": "2.4.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request. Exploitation requires developers to pass unsanitized user input directly into headers.The server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers. This vulnerability is fixed in 2.4.6."}, {"lang": "es", "value": "BlackSheep es un framework web as\u00edncrono para construir aplicaciones web basadas en eventos con Python. Antes de la versi\u00f3n 2.4.6, la implementaci\u00f3n del Cliente HTTP en BlackSheep es vulnerable a la inyecci\u00f3n CRLF. La falta de validaci\u00f3n de encabezados hace posible que un atacante modifique las solicitudes HTTP (p. ej., insertar un nuevo encabezado) o incluso cree una nueva solicitud HTTP. La explotaci\u00f3n requiere que los desarrolladores pasen la entrada de usuario no saneada directamente a los encabezados. La parte del servidor no se ve afectada porque BlackSheep delega a un servidor ASGI subyacente el manejo de los encabezados de respuesta. Esta vulnerabilidad se corrige en la versi\u00f3n 2.4.6."}], "id": "CVE-2026-22779", "lastModified": "2026-06-17T10:20:24.680", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22779", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T21:01:45.365112Z", "version": "2.0.3"}}]}, "published": "2026-01-14T17:16:09.150", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-113"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:20:17.393083+00:00", "value": {"mitigation_remediation": ["Update BlackSheep to version 2.4.6 or later.", "Validate or sanitize all user input before passing it to HTTP header fields.", "Audit existing code to ensure no unsanitized user input is used in header construction, and restrict header modifications to trusted code paths."], "summary": {"action": "Immediate Patch", "impact": "CRLF injection in HTTP client enabling header manipulation"}, "threat_synthesis": {"affected_systems": "Neoteroi\u2019s BlackSheep asynchronous web framework, versions prior to 2.4.6, is impacted. Any Python application building its own HTTP client using these versions may propagate unsanitized header values into outgoing requests.", "description_and_impact": "The vulnerability arises from a lack of validation in BlackSheep\u2019s HTTP Client, allowing malicious input to inject Carriage Return and Line Feed characters into request headers. This injection can alter the outgoing request or create a new HTTP request entirely by appending arbitrary headers. Because the server component delegates response handling to the underlying ASGI server, only the client side is affected. The flaw provides a route for altering request semantics without the protecting infrastructure, potentially leading to information disclosure or request forging if the crafted headers influence downstream services.", "risk_and_exploitability": "The CVSS score of 6.3 indicates a moderate severity, while an EPSS of less than 1% reflects a very low intent or probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Exploitation requires developers to inject unsanitized user data into header fields. If an attacker can influence that input, they can modify request headers to influence the behavior of downstream services or insert harmful headers, but the likelihood of such injection in production environments is low and the impact is contained to the client-side request path."}}}}, "created": "2026-01-15T08:03:38.329647+00:00", "updated": "2026-04-18T06:30:25.903627+00:00", "vendors": ["neoteroi", "neoteroi$PRODUCT$blacksheep"]}