{"id":"CVE-2026-22779","aliases":["GHSA-6pw3-h7xf-x4gp","PYSEC-2026-1222"],"title":"BlackSheep's ClientSession is vulnerable to CRLF injection","summary":"BlackSheep's ClientSession is vulnerable to CRLF injection","severity":"medium","vendor":"blacksheep","product":"blacksheep","ecosystem":"pip","affected":["blacksheep < 2.4.6"],"patched":["blacksheep 2.4.6"],"published":"2026-01-14","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6pw3-h7xf-x4gp","references":[{"url":"https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gp"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22779"},{"url":"https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12"},{"url":"https://github.com/Neoteroi/BlackSheep"},{"url":"https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6"}],"tags":["osv","pip"],"epss":0.00359,"epssPercentile":0.29755,"ingestedAt":"2026-07-08T18:25:46.507Z","slug":"CVE-2026-22779","body":"## Overview\n\n### Impact\nThe HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request.\nExploitation requires developers to pass unsanitized user input directly into headers.\nThe server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers.\n\n**Attack vector:** Applications using user input in HTTP client requests (method, URL, headers).\n\n### Patches\nUsers who use the HTTP Client in BlackSheep should upgrade to `2.4.6`.\n\n### Workarounds\nIf users handle headers from untrusted parties, they might reject values for header names and values that contain carriage returns.\n\n### References\nhttps://owasp.org/www-community/vulnerabilities/CRLF_Injection\n\n## Affected packages\n\n- `blacksheep < 2.4.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `blacksheep 2.4.6`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}