CVE-2020-26116: canonical ubuntu_linux

Modified

AliasesSUSE-SU-2020:14550-1SUSE-SU-2020:3115-1SUSE-SU-2020:3121-1+12 more

Published 27-09-2020Last modified 14-10-2026

Vulnerability summary

CVE-2020-26116 is a high (CVSS 7.2) vulnerability in canonical ubuntu_linux. EPSS estimates a 6.36% chance of exploitation in the next 30 days, higher than 93.6% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.2/10

010

High · v3.1 (NVD)

EPSS score

6.36%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 19 · Related 9

DLA-2456-1 DLA-3432-1 MGASA-2020-0451 OPENSUSE-SU-2020:2332-1 OPENSUSE-SU-2020:2333-1 OPENSUSE-SU-2024:11284-1+13 more

Timeline

27-09-2020
PublishedVulnerability first disclosed.
14-10-2026
Last modifiedVulnerability information updated.

Description

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.17.2v2.06.4

EPSS trend

Probability

6.36%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

No change 0.00 pp

From 6.36% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugs.python.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse48 products

python-base&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 2.7.17-7.44.2
python-base&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 2.7.17-7.44.2
python-base&distro=SUSE Linux Enterprise Module for Python 2 15 SP1< 2.7.17-7.44.2
python-base&distro=SUSE Linux Enterprise Module for Python 2 15 SP2< 2.7.17-7.44.2
python-base&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 2.6.9-40.48.1

python-base&distro=SUSE Linux Enterprise Server 11 SP4-LTSS< 2.6.9-40.48.1
python-base&distro=SUSE Linux Enterprise Server 12 SP5< 2.7.17-28.56.1
python-base&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.7.17-28.56.1
python-base&distro=SUSE Linux Enterprise Workstation Extension 12 SP5< 2.7.17-28.56.1
python-doc&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 2.6-8.40.48.1
python-doc&distro=SUSE Linux Enterprise Server 11 SP4-LTSS< 2.6-8.40.48.1
python-doc&distro=SUSE Linux Enterprise Server 12 SP5< 2.7.17-28.56.1
python-doc&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.7.17-28.56.1
python-urllib3&distro=HPE Helion OpenStack 8< 1.22-5.15.1
python-urllib3&distro=SUSE Enterprise Storage 5< 1.22-3.23.1
python-urllib3&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 1.22-6.12.1
python-urllib3&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 1.22-6.12.1
python-urllib3&distro=SUSE Linux Enterprise Module for Public Cloud 12< 1.22-3.23.1
python-urllib3&distro=SUSE Linux Enterprise Server 12 SP5< 1.22-3.23.1
python-urllib3&distro=SUSE Linux Enterprise Server 15-LTSS< 1.22-6.12.1
python-urllib3&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.22-3.23.1
python-urllib3&distro=SUSE Linux Enterprise Server for SAP Applications 15< 1.22-6.12.1
python-urllib3&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 1.22-3.23.1
python-urllib3&distro=SUSE Linux Enterprise Workstation Extension 12 SP5< 1.22-3.23.1
python-urllib3&distro=SUSE OpenStack Cloud 7< 1.16-3.15.1
python-urllib3&distro=SUSE OpenStack Cloud 8< 1.22-5.15.1
python-urllib3&distro=SUSE OpenStack Cloud 9< 1.23-3.18.1
python-urllib3&distro=SUSE OpenStack Cloud Crowbar 8< 1.22-5.15.1
python-urllib3&distro=SUSE OpenStack Cloud Crowbar 9< 1.23-3.18.1
python3-base&distro=SUSE Linux Enterprise Module for Web and Scripting 12< 3.4.10-25.55.1
python3-base&distro=SUSE Linux Enterprise Server 12 SP5< 3.4.10-25.55.1
python3-base&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 3.4.10-25.55.1
python3-base&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 3.4.10-25.55.1
python3&distro=SUSE Linux Enterprise Module for Web and Scripting 12< 3.4.10-25.55.1
python3&distro=SUSE Linux Enterprise Server 12 SP5< 3.4.10-25.55.1
python3&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 3.4.10-25.55.1
python3&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 3.4.10-25.55.1
python&distro=SUSE Enterprise Storage 5< 2.7.17-28.56.1
python&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 2.7.17-7.44.4
python&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 2.7.17-7.44.4
python&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1< 2.7.17-7.44.4
python&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP2< 2.7.17-7.44.4
python&distro=SUSE Linux Enterprise Module for Python 2 15 SP1< 2.7.17-7.44.4
python&distro=SUSE Linux Enterprise Module for Python 2 15 SP2< 2.7.17-7.44.4
python&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 2.6.9-40.48.1
python&distro=SUSE Linux Enterprise Server 11 SP4-LTSS< 2.6.9-40.48.1
python&distro=SUSE Linux Enterprise Server 12 SP5< 2.7.17-28.56.1
python&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.7.17-28.56.1

Show all 48

Redhat10 products

platform-python< 0:3.6.8-24.el8_2
platform-python-debug< 0:3.6.8-24.el8_2
platform-python-devel< 0:3.6.8-24.el8_2
python3< 0:3.6.8-24.el8_2
python3-debuginfo< 0:3.6.8-24.el8_2

Show all 10

Opensuse7 products

leapEOL15.1
python-base&distro=openSUSE Leap 15.1< 2.7.17-lp151.10.25.1
python-base&distro=openSUSE Leap 15.2< 2.7.17-lp152.3.6.2
python-doc&distro=openSUSE Leap 15.1< 2.7.17-lp151.10.25.1
python-doc&distro=openSUSE Leap 15.2< 2.7.17-lp152.3.6.1

Show all 7

Ubuntu6 products

python2.7< 2.7.6-8ubuntu0.6+esm7 | < 2.7.12-1ubuntu0~16.04.13 | < 2.7.17-1~18.04ubuntu1.2
python3.4< 3.4.3-1ubuntu1~14.04.7+esm8
python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.12
python3.6< 3.6.9-1~18.04ubuntu1.3
python3.7< 3.7.5-2ubuntu1~18.04.2+esm3

Show all 6

Debian2 products

pypy3< 7.3.3+dfsg-1
debian_linuxEOL9.0

Netapp2 products

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04

Fedoraproject1 product

fedoraEOL31 | 32 | 33

Oracle1 product

zfs_storage_appliance_kit8.8

Python1 product

python≥ 3.0.0, < 3.5.10 | ≥ 3.6.0, < 3.6.12 | ≥ 3.7.0, < 3.7.9 | ≥ 3.8.0, < 3.8.5

10 vendors · 79 products

References

41 links

python-security.readthedocs.io/vuln/http-header-injection-method.htmlARTICLEREPORTPatchThird Party Advisory
bugs.python.org/issue39603ARTICLEExploitIssue TrackingPatchVendor Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
usn.ubuntu.com/4581-1/Vendor AdvisoryThird Party Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.htmlVendor AdvisoryMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
lists.debian.org/debian-lts-announce/2020/11/msg00032.htmlMailing ListThird Party Advisory

Show all 41 references

security.gentoo.org/glsa/202101-18Vendor AdvisoryThird Party Advisory
www.oracle.com/security-alerts/cpuoct2021.htmlPatchThird Party Advisory
security.netapp.com/advisory/ntap-20201023-0001/Third Party Advisory
lists.debian.org/debian-lts-announce/2023/05/msg00024.htmlMailing List
www.suse.com/support/update/announcement/2020/suse-su-202014550-1/Advisory
bugzilla.suse.com/1177211REPORT
www.suse.com/security/cve/CVE-2020-26116WEB
www.suse.com/support/update/announcement/2020/suse-su-20203115-1/Advisory
www.suse.com/support/update/announcement/2020/suse-su-20203121-1/Advisory
www.suse.com/support/update/announcement/2020/suse-su-20203262-1/Advisory
www.suse.com/support/update/announcement/2021/suse-su-20210299-1/Advisory
www.suse.com/support/update/announcement/2021/suse-su-20210341-1/Advisory
bugzilla.suse.com/1181571REPORT
www.suse.com/support/update/announcement/2021/suse-su-20210342-1/Advisory
www.suse.com/support/update/announcement/2021/suse-su-20210486-1/Advisory
www.suse.com/support/update/announcement/2021/suse-su-20210515-1/Advisory
access.redhat.com/errata/RHSA-2021:3366Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1883014REPORT
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3366.jsonAdvisory
access.redhat.com/security/cve/CVE-2020-26116REPORT
www.cve.org/CVERecord?id=CVE-2020-26116AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2020-26116AdvisoryOval
ubuntu.com/security/CVE-2020-26116REPORT
ubuntu.com/security/notices/USN-4581-1Advisory
ubuntu.com/security/notices/USN-4754-3Advisory
ubuntu.com/security/notices/USN-6891-1Advisory
security-tracker.debian.org/tracker/CVE-2020-26116Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
cert-portal.siemens.com/productcert/html/ssa-398330.html