CVE-2026-22779

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22779
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22779.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22779
Aliases
Published
2026-01-14T16:49:34.202Z
Modified
2026-03-01T02:56:12.467836Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
BlackSheep ClientSession is vulnerable to CRLF injection
Details

BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request. Exploitation requires developers to pass unsanitized user input directly into headers.The server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers. This vulnerability is fixed in 2.4.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-113"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22779.json"
}
References

Affected packages

Git / github.com/neoteroi/blacksheep

Affected ranges

Type
GIT
Repo
https://github.com/neoteroi/blacksheep
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1884df0ca8b96901195d0d4f2832c279c603fd46

Affected versions

Other
before-asgi
v0.*
v0.2.7
v0.2.8
v0.2.9
v0.3.0b
v0.3.0c
v0.3.1
v0.3.2
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0a0
v2.0a1
v2.0a10
v2.0a11
v2.0a12
v2.0a2
v2.0a3
v2.0a4
v2.0a5
v2.0a6
v2.0a7
v2.0a8
v2.0a9
v2.1.0
v2.2.0
v2.3.0
v2.3.1
v2.3.1a1
v2.3.2
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22779.json"