CVE-2020-7695: HTTP Response Splitting
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Other sources
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-7695?
CVE-2020-7695 is a vulnerability in Uvicorn before 0.11.7 that allows for HTTP response splitting.
How can an attacker exploit CVE-2020-7695?
Attackers can exploit CVE-2020-7695 by using crafted input to add arbitrary headers to HTTP responses or return arbitrary response bodies.
What is the severity of CVE-2020-7695?
CVE-2020-7695 has a severity score of 5.3 (medium).
Which software versions are affected by CVE-2020-7695?
Uvicorn versions up to and excluding 0.11.7 are affected by CVE-2020-7695.
How can I fix CVE-2020-7695?
To fix CVE-2020-7695, update Uvicorn to version 0.11.7 or later.