CVE-2025-15282

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

PSF·CWE-93·Published 2026-01-20

CVSS

—

EPSS

0.00

KEV

Exploits

cve.orgen

130 chars

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

NVDen

130 chars

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

NVDes

185 chars

URLs de datos controladas por el usuario analizadas por urllib.request.DataHandler permiten la inyección de encabezados a través de nuevas líneas en el tipo de medio de la URL de datos.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
4.0	Primary	cve.org	6.0	—	—	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N
4.0	Secondary	NVD	6.0	—	—