ZeroDay Findings
Sign inSign up

Findings

CVE-2023-24329

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Published Feb 17, 2023 · updated Oct 14, 2026 · python python

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 17, 2023 · NIST NVD

    Detected

    An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

  2. Oct 14, 2026 · NIST NVD

    Updated

    An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Affected

  • cpe fedoraproject/fedora36
  • cpe fedoraproject/fedora37
  • cpe fedoraproject/fedora38
  • cpe netapp/active iq unified managerversion unspecified
  • cpe python/pythonversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2023-24329

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2023-24329

    30-day exploitation probability 20.5%

    first.org
  • NIST NVDVulnerability recordCVE-2023-24329

    An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

    nvd.nist.gov

References