CVE-2022-0391
A flaw was found in Python, specifically within the urllib.parse module.
Published Feb 9, 2022 · updated Oct 14, 2026 · python python
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
Timeline
Detection, updates, and resolution for this record.
Feb 9, 2022 · NIST NVD
Detected
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior
Affected
- cpe fedoraproject/fedora34
- cpe netapp/active iq unified managerversion unspecified
- cpe oracle/http server12.2.1.3.0
- cpe python/pythonversion unspecified
- cpe python/python3.10.0
Sources
- CVE.orgCVE-2022-0391
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-0391
30-day exploitation probability 8.3%
first.org - NIST NVDCVE-2022-0391
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. Th
nvd.nist.gov