CVE-2026-22779
Medium · 6.5BlackSheep's ClientSession is vulnerable to CRLF injection
CVSS
6.5
EPSS
0.4%
Published
Jan 14, 2026
CISA due date
—
The record
The HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request. Exploitation requires developers to pass unsanitized user input directly into headers. The server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers. **Attack vector:** Applications using user input in HTTP client requests (method, URL, headers).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | blacksheep | 0 | 2.4.6 |
Related vulnerabilities
- GHSA-6pw3-h7xf-x4gp BlackSheep's ClientSession is vulnerable to CRLF injection Same vulnerability
- CVE-2026-2811 The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection… CWE-113
- CVE-2026-77341 cpp-httplib is a C++ header-only HTTP/HTTPS library. CWE-113
- CVE-2026-75419 go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. CWE-113
- CVE-2026-50576 ePA 3.x Integration implements the authorization workflow and writes Medical Information… CWE-113
- CVE-2026-54163 secure_headers manages application of security headers with many safe defaults. CWE-113
- CVE-2026-50188 Kirby is an open-source content management system. CWE-113
- CVE-2026-55766 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. CWE-113