bottle.py vulnerable to CRLF Injection

Also known as GHSA-j6f7-hghw-g437, PYSEC-2016-24

Published 9 y ago 2016-12-16 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.8%

percentile 78%

Public exploits

none known

redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

Exploit prediction (EPSS)

1.76% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`
GitHub	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
pypi	`bottle`	>=0.10.1, <0.12.11	0.12.11

Classification

Weakness

CWE-93 Improper Neutralization of CRLF Sequences

References

github.com /bottlepy/bottle/issues/913 · x_refsource_CONFIRM, x_transferred
github.com /bottlepy/bottle/commit/6d7e13da0f998820800ecb3fe9ccee4189aefb54 · x_refsource_CONFIRM, x_transferred
debian.org /security/2016/dsa-3743 · vendor-advisory, x_refsource_DEBIAN, x_transferred
securityfocus.com /bid/94961 · vdb-entry, x_refsource_BID, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-9964 · advisory
github.com /bottlepy/bottle/commit/78f67d51965db11cb1ed0003f1eb7926458b5c2c · web
github.com /advisories/GHSA-j6f7-hghw-g437 · advisory
github.com /bottlepy/bottle · package
github.com /pypa/advisory-database/tree/main/vulns/bottle/PYSEC-2016-24.yaml · web
web.archive.org /web/20170214030628/http://www.securityfocus.com/bid/94961 · web

Sources

CVE List: CVE-2016-9964
GitHub Advisory: GHSA-j6f7-hghw-g437
NVD: CVE-2016-9964
OSV: PYSEC-2016-24

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.