Skip to content

Product

debian/python-uvicorn vulnerabilities

2 published CVES affecting debian/python-uvicorn, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest debian/python-uvicorn CVEs

Newest publication first

  1. CVE-2020-7695 HTTP Response Splitting

    Published
    MediumCVSS 5.3

    Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to constru...

  2. CVE-2020-7694 Log Injection

    Published
    HighCVSS 7.5 EPSS 1.4%

    This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attack...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.