Vulnerability Description
BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request. Exploitation requires developers to pass unsanitized user input directly into headers.The server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers. This vulnerability is fixed in 2.4.6.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Neoteroi | Blacksheep | < 2.4.6 |
Related Weaknesses (CWE)
References
- https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90Patch
- https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6Release Notes
- https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gpThird Party Advisory
FAQ
What is CVE-2026-22779?
CVE-2026-22779 is a vulnerability with a CVSS score of 5.3 (MEDIUM). BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing hea...
How severe is CVE-2026-22779?
CVE-2026-22779 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-22779?
Check the references section above for vendor advisories and patch information. Affected products include: Neoteroi Blacksheep.