CVE-2022-0391 - AskarLabs CVE Database

CVE-2022-0391

Vendor N/A

Product python

Weakness CWE-74

Published February 9, 2022

Last update December 17, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

Key dates

02Disclosure timeline

February 9, 2022 CVE published

December 17, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0391 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/74.html

Related vulnerabilities

04Related CVE

CVE-2021-32649 Authenticated file write leads to remote code execution in october/system CVE-2026-11457 erzhongxmu JeeWMS JimuReport test-connection Endpoint testConnection injection CVE-2025-20283 Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability CVE-2025-64099 OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info CVE-2020-11002 Remote Code Execution (RCE) vulnerability in dropwizard-validation