CVE-2025-15282: Header injection via newlines in data URL mediatype
Deferred
AliasesUBUNTU-CVE-2025-15282DEBIAN-CVE-2025-15282CGA-456q-ww7g-34m5CGA-546f-mm85-qc56CGA-54mp-4r3j-27jmCGA-72jf-r4g8-9746CGA-9w5q-4cf9-xw75CGA-c885-m3j5-8x5qCGA-ggx6-mg23-9fcxCGA-gwc4-87m7-5h5jCGA-m2qx-wv5q-wpr4CGA-vf4c-qmp6-9c5jCGA-6gw9-pvf3-vwggCGA-v6h5-378r-qjj4
Published 20-01-2026Last modified 03-03-2026
Vulnerability summary
CVE-2025-15282 is a medium (CVSS 6.0) vulnerability in python software foundation cpython. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 45.3% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 6, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
6.0/10
010
Medium · v4.0 (CVE.org)EPSS score
0.54%
0%100%
Low · -0.01 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 33 · Related 27DLA-4455-1MGASA-2026-0455OPENSUSE-SU-2026:10152-1OPENSUSE-SU-2026:10200-1OPENSUSE-SU-2026:10206-1OPENSUSE-SU-2026:10221-1OPENSUSE-SU-2026:10222-1OPENSUSE-SU-2026:10223-1OPENSUSE-SU-2026:20254-1RHSA-2026:10950RHSA-2026:19064RHSA-2026:19177RHSA-2026:7443RHSA-2026:7661RHSA-2026:8822RHSA-2026:8824SUSE-SU-2026:0612-1SUSE-SU-2026:0613-1SUSE-SU-2026:0642-1SUSE-SU-2026:0643-1SUSE-SU-2026:0644-1SUSE-SU-2026:0645-1SUSE-SU-2026:0664-1SUSE-SU-2026:0693-1SUSE-SU-2026:0767-1SUSE-SU-2026:1117-1SUSE-SU-2026:1349-1SUSE-SU-2026:20543-1SUSE-SU-2026:20581-1SUSE-SU-2026:20665-1SUSE-SU-2026:20710-1SUSE-SU-2026:20768-1SUSE-SU-2026:20796-1CGA-677H-PF23-HQMPUSN-8018-1USN-8018-3
Timeline
- 20-01-2026PublishedVulnerability first disclosed.
- 03-03-2026Last modifiedVulnerability information updated.
Description
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 6.0Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N
- OSV · DebianEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N
- NVDNIST6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 0.55% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu12 products
- python2.7< 2.7.6-8ubuntu0.6+esm29 | < 2.7.12-1ubuntu0~16.04.18+esm19 | < 2.7.17-1~18.04ubuntu1.13+esm14 | < 2.7.18-13ubuntu1.5+esm8
- python3.10< 3.10.12-1~22.04.14
- python3.11< 3.11.0~rc1-1~22.04.1~esm8
- python3.12< 3.12.3-1ubuntu0.11
- python3.13< 3.13.7-1ubuntu0.3
Chainguard6 products
- python-3.10< 3.10.19-r4
- python-3.11< 3.11.14-r5
- python-3.12< 3.12.12-r5
- python-3.13< 3.13.12-r1
- python-3.14< 3.14.3-r1
Wolfi5 products
- python-3.10< 3.10.19-r4
- python-3.11< 3.11.14-r5
- python-3.12< 3.12.12-r5
- python-3.13< 3.13.12-r1
- python-3.14< 3.14.3-r1
Debian4 products
- pypy3All versions (No fix recorded) | < 7.3.21+dfsg-1
- python3.11< 3.11.2-6+deb12u7
- python3.13< 3.13.12-1 | < 3.13.5-2+deb13u1
- python3.14< 3.14.3-1
Python software foundation1 product
- cpython< 3.10.20 | ≥ 3.11.0, < 3.11.15 | ≥ 3.12.0, < 3.12.13 | ≥ 3.13.0, < 3.13.12 | ≥ 3.14.0, < 3.14.3 | ≥ 3.15.0a1, < 3.15.0a6
5 vendors · 28 products
References
17 links- mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/Vendor AdvisoryREPORTAdvisory
Show all 17 references
- github.com/python/cpythonPACKAGE