Search
Find a vulnerability
Search criteria
Related vulnerabilities
BREW-CYCODE-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:42 – Updated: 2026-09-16 08:55 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.53.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "cycode",
"purl": "pkg:brew/cycode"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.19.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.53.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.53.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-cycode-CVE-2020-7695",
"modified": "2026-09-16T08:55:38Z",
"published": "2026-08-13T16:42:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-DATASETTE-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:42 – Updated: 2026-09-12 08:50 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.4",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "datasette",
"purl": "pkg:brew/datasette"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.65.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.4",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.4"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-datasette-CVE-2020-7695",
"modified": "2026-09-12T08:50:44Z",
"published": "2026-08-13T16:42:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-DSTACK-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:43 – Updated: 2026-09-09 23:52 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.4",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "dstack",
"purl": "pkg:brew/dstack"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.4",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.4"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-dstack-CVE-2020-7695",
"modified": "2026-09-09T23:52:28Z",
"published": "2026-08-13T16:43:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-ESPHOME-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:45 – Updated: 2026-09-09 23:53 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.40.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "esphome",
"purl": "pkg:brew/esphome"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.7.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.40.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.40.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-esphome-CVE-2020-7695",
"modified": "2026-09-09T23:53:49Z",
"published": "2026-08-13T16:45:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-FASTAPI-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:46 – Updated: 2026-09-09 23:55 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "fastapi",
"purl": "pkg:brew/fastapi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.141.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-fastapi-CVE-2020-7695",
"modified": "2026-09-09T23:55:50Z",
"published": "2026-08-13T16:46:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-FASTMCP-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:46 – Updated: 2026-09-09 23:56 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.4",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "fastmcp",
"purl": "pkg:brew/fastmcp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.4",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.4"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-fastmcp-CVE-2020-7695",
"modified": "2026-09-09T23:56:32Z",
"published": "2026-08-13T16:46:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-GLANCES-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:51 – Updated: 2026-09-28 18:24 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.54.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "glances",
"purl": "pkg:brew/glances"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.54.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.54.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-glances-CVE-2020-7695",
"modified": "2026-09-28T18:24:14Z",
"published": "2026-08-13T16:51:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-GPTME-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:54 – Updated: 2026-09-10 00:05 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.4",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "gptme",
"purl": "pkg:brew/gptme"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.32.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.4",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.4"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-gptme-CVE-2020-7695",
"modified": "2026-09-10T00:05:56Z",
"published": "2026-08-13T16:54:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-HERMES-AGENT-CVE-20… (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:56 – Updated: 2026-09-10 19:27 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.4",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "hermes-agent",
"purl": "pkg:brew/hermes-agent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.8.3_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.4",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.4"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-hermes-agent-CVE-2020-7695",
"modified": "2026-09-10T19:27:17Z",
"published": "2026-08-13T16:56:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-KIMI-CLI-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:01 – Updated: 2026-09-10 00:17 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.51.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "kimi-cli",
"purl": "pkg:brew/kimi-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.48.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.51.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.51.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-kimi-cli-CVE-2020-7695",
"modified": "2026-09-10T00:17:52Z",
"published": "2026-08-13T17:01:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-MCP-ATLASSIAN-CVE-2… (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:13 – Updated: 2026-09-10 00:30 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.3",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "mcp-atlassian",
"purl": "pkg:brew/mcp-atlassian"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.3",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.3"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-mcp-atlassian-CVE-2020-7695",
"modified": "2026-09-10T00:30:25Z",
"published": "2026-08-13T17:13:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-MCP-GOOGLE-SHEETS-C… (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:13 – Updated: 2026-09-10 00:30 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.51.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "mcp-google-sheets",
"purl": "pkg:brew/mcp-google-sheets"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.3_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.51.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.51.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-mcp-google-sheets-CVE-2020-7695",
"modified": "2026-09-10T00:30:25Z",
"published": "2026-08-13T17:13:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-MCP-PROXY-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:13 – Updated: 2026-09-10 00:30 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.51.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "mcp-proxy",
"purl": "pkg:brew/mcp-proxy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.12.0_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.51.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.51.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-mcp-proxy-CVE-2020-7695",
"modified": "2026-09-10T00:30:25Z",
"published": "2026-08-13T17:13:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-MCPM-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:13 – Updated: 2026-09-10 19:56 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.49.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "mcpm",
"purl": "pkg:brew/mcpm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.15.0_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.49.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.49.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-mcpm-CVE-2020-7695",
"modified": "2026-09-10T19:56:14Z",
"published": "2026-08-13T17:13:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-MISTRAL-VIBE-CVE-20… (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:14 – Updated: 2026-09-10 00:31 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.46.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "mistral-vibe",
"purl": "pkg:brew/mistral-vibe"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.24.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.46.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.46.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-mistral-vibe-CVE-2020-7695",
"modified": "2026-09-10T00:31:16Z",
"published": "2026-08-13T17:14:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-OMNARA-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:19 – Updated: 2026-09-10 00:41 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.38.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "omnara",
"purl": "pkg:brew/omnara"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.38.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.38.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-omnara-CVE-2020-7695",
"modified": "2026-09-10T00:41:55Z",
"published": "2026-08-13T17:19:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-OTERM-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:24 – Updated: 2026-09-10 20:19 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.4",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "oterm",
"purl": "pkg:brew/oterm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.4",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.4"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-oterm-CVE-2020-7695",
"modified": "2026-09-10T20:19:31Z",
"published": "2026-08-13T17:24:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-PIECES-CLI-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-09-10 00:53 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.49.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "pieces-cli",
"purl": "pkg:brew/pieces-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.20.1_7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.49.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.49.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-pieces-cli-CVE-2020-7695",
"modified": "2026-09-10T00:53:26Z",
"published": "2026-08-13T17:28:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-PLATFORMIO-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-10-04 10:45 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.54.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "platformio",
"purl": "pkg:brew/platformio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.19_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.54.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.54.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-platformio-CVE-2020-7695",
"modified": "2026-10-04T10:45:30Z",
"published": "2026-08-13T17:28:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-POCKET-TTS-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-09-10 00:58 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.4",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "pocket-tts",
"purl": "pkg:brew/pocket-tts"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.4",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.4"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-pocket-tts-CVE-2020-7695",
"modified": "2026-09-10T00:58:00Z",
"published": "2026-08-13T17:28:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-RAPID-MLX-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:32 – Updated: 2026-09-10 20:37 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.4",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "rapid-mlx",
"purl": "pkg:brew/rapid-mlx"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.12.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.4",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.4"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-rapid-mlx-CVE-2020-7695",
"modified": "2026-09-10T20:37:34Z",
"published": "2026-08-13T17:32:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-SEMGREP-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-09-10 01:12 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.4",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "semgrep",
"purl": "pkg:brew/semgrep"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.172.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.4",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.4"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-semgrep-CVE-2020-7695",
"modified": "2026-09-10T01:12:04Z",
"published": "2026-08-13T17:34:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-SNYK-AGENT-SCAN-CVE… (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:35 – Updated: 2026-09-10 01:16 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.4",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "snyk-agent-scan",
"purl": "pkg:brew/snyk-agent-scan"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.4",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.4"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-snyk-agent-scan-CVE-2020-7695",
"modified": "2026-09-10T01:16:38Z",
"published": "2026-08-13T17:35:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-STRANDS-AGENTS-SOPS… (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:41 – Updated: 2026-09-10 21:05 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.52.4",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "strands-agents-sops",
"purl": "pkg:brew/strands-agents-sops"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.52.4",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.52.4"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-strands-agents-sops-CVE-2020-7695",
"modified": "2026-09-10T21:05:20Z",
"published": "2026-08-13T17:41:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-SYSAIDMIN-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:42 – Updated: 2026-09-10 01:24 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.51.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "sysaidmin",
"purl": "pkg:brew/sysaidmin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.5_19"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.51.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.51.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-sysaidmin-CVE-2020-7695",
"modified": "2026-09-10T01:24:31Z",
"published": "2026-08-13T17:42:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-THEHARVESTER-CVE-20… (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:43 – Updated: 2026-09-10 01:28 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "uvicorn",
"resource_purl": "pkg:pypi/uvicorn@0.48.0",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "theharvester",
"purl": "pkg:brew/theharvester"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.11.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.48.0",
"name": "uvicorn",
"resource": "uvicorn",
"strategy": "registry",
"subject_version": "0.48.0"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-theharvester-CVE-2020-7695",
"modified": "2026-09-10T01:28:32Z",
"published": "2026-08-13T17:43:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
BREW-UVICORN-CVE-2020-7695 (GHSA-F97H-2PFX-F59F)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:46 – Updated: 2026-09-28 19:07 – Source website
VLAI
Summary
HTTP response splitting in uvicorn
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "0.11.7"
},
"package": {
"ecosystem": "Homebrew",
"name": "uvicorn",
"purl": "pkg:brew/uvicorn"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.52.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/uvicorn@0.54.0",
"name": "uvicorn",
"strategy": "registry",
"subject_version": "0.54.0"
},
{
"ecosystem": "Debian",
"key": "Debian/python-uvicorn",
"name": "python-uvicorn",
"strategy": "distro"
},
{
"ecosystem": "GIT",
"key": "upstream:https://github.com/kludex/uvicorn",
"name": "https://github.com/kludex/uvicorn",
"strategy": "distro",
"subject_version": "0.54.0"
},
{
"ecosystem": "PyPI",
"key": "upstream:pkg:pypi/uvicorn@0.54.0",
"name": "uvicorn",
"strategy": "distro",
"subject_version": "0.54.0"
},
{
"ecosystem": "Ubuntu",
"key": "Ubuntu/python-uvicorn",
"name": "python-uvicorn",
"strategy": "distro"
}
]
},
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "BREW-uvicorn-CVE-2020-7695",
"modified": "2026-09-28T19:07:32Z",
"published": "2026-08-13T17:46:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7695"
},
{
"type": "PACKAGE",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-151.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HTTP response splitting in uvicorn",
"upstream": [
"GHSA-f97h-2pfx-f59f",
"CVE-2020-7695",
"PYSEC-2020-151",
"SNYK-PYTHON-UVICORN-570471"
]
}
PYSEC-2020-151
Vulnerability from pysec - Published: 2020-07-27 12:15 - Updated: 2020-07-29 19:15
VLAI
Details
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Impacted products
| Name | purl | uvicorn | pkg:pypi/uvicorn |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "uvicorn",
"purl": "pkg:pypi/uvicorn"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.1",
"0.0.2",
"0.0.3",
"0.0.4",
"0.0.5",
"0.0.6",
"0.0.7",
"0.0.8",
"0.0.9",
"0.0.10",
"0.0.11",
"0.0.12",
"0.0.13",
"0.0.14",
"0.0.15",
"0.1.0",
"0.1.1",
"0.2.0",
"0.2.1",
"0.2.2",
"0.2.3",
"0.2.4",
"0.2.5",
"0.2.6",
"0.2.7",
"0.2.8",
"0.2.9",
"0.2.10",
"0.2.11",
"0.2.12",
"0.2.13",
"0.2.14",
"0.2.15",
"0.2.16",
"0.2.17",
"0.2.18",
"0.2.19",
"0.2.20",
"0.2.21",
"0.2.22",
"0.3.0",
"0.3.1",
"0.3.2",
"0.3.3",
"0.3.4",
"0.3.5",
"0.3.6",
"0.3.7",
"0.3.8",
"0.3.9",
"0.3.10",
"0.3.11",
"0.3.12",
"0.3.13",
"0.3.14",
"0.3.15",
"0.3.16",
"0.3.17",
"0.3.18",
"0.3.19",
"0.3.20",
"0.3.21",
"0.3.22",
"0.3.23",
"0.3.24",
"0.3.25",
"0.3.26",
"0.3.27",
"0.3.28",
"0.3.29",
"0.3.30",
"0.3.31",
"0.3.32",
"0.4.0",
"0.4.1",
"0.4.2",
"0.4.3",
"0.4.4",
"0.4.5",
"0.4.6",
"0.5.0",
"0.5.1",
"0.5.2",
"0.6.0",
"0.6.1",
"0.7.0b1",
"0.7.0b2",
"0.7.0",
"0.7.1",
"0.7.2",
"0.7.3",
"0.8.0",
"0.8.1",
"0.8.2",
"0.8.3",
"0.8.4",
"0.8.5",
"0.8.6",
"0.9.0",
"0.9.1",
"0.10.0",
"0.10.1",
"0.10.2",
"0.10.3",
"0.10.4",
"0.10.5",
"0.10.6",
"0.10.7",
"0.10.8",
"0.10.9",
"0.11.0",
"0.11.1",
"0.11.2",
"0.11.3",
"0.11.4",
"0.11.5",
"0.11.6"
]
}
],
"aliases": [
"CVE-2020-7695",
"SNYK-PYTHON-UVICORN-570471",
"GHSA-f97h-2pfx-f59f"
],
"details": "Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.",
"id": "PYSEC-2020-151",
"modified": "2020-07-29T19:15:00Z",
"published": "2020-07-27T12:15:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471"
},
{
"type": "WEB",
"url": "https://github.com/encode/uvicorn"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-f97h-2pfx-f59f"
}
]
}