--- id: CVE-2019-9636 title: >- Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization summary: >- Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cach… severity: critical cvss: 9.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-173 vendor: python product: python affected: - 'python >= 2.7.0, < 2.7.17' - 'python >= 3.0.0, < 3.4.10' - 'python >= 3.5.0, < 3.5.7' - 'python >= 3.6.0, < 3.6.9' - 'python >= 3.7.0, < 3.7.3' - fedora = 28 - fedora = 29 - fedora = 30 - fedora = 31 - leap = 15.0 - leap = 15.1 - leap = 42.3 - debian_linux = 8.0 - debian_linux = 9.0 - ubuntu_linux = 12.04 - ubuntu_linux = 14.04 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 19.04 - openshift_container_platform = 3.11 - enterprise_linux = 7.5 - enterprise_linux = 8.0 - enterprise_linux_desktop = 6.0 - enterprise_linux_eus = 7.5 - enterprise_linux_eus = 8.1 - enterprise_linux_eus = 8.2 - enterprise_linux_eus = 8.4 - enterprise_linux_eus = 8.6 - enterprise_linux_server = 6.0 - enterprise_linux_server_aus = 7.4 - enterprise_linux_server_aus = 8.2 - enterprise_linux_server_aus = 8.4 - enterprise_linux_server_eus = 5.6 - enterprise_linux_server_tus = 7.4 - enterprise_linux_server_tus = 8.2 - enterprise_linux_server_tus = 8.4 - enterprise_linux_server_tus = 8.6 - enterprise_linux_workstation = 6.0 - virtualization = 4.0 - sun_zfs_storage_appliance_kit = 8.8.6 patched: - python 3.7.3 published: '2019-03-08' updated: '2026-10-07' sourceUpdated: '2026-10-07T19:17:14.490' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-9636' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html' label: cve@mitre.org - url: 'http://www.securityfocus.com/bid/107400' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHBA-2019:0763' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHBA-2019:0764' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHBA-2019:0959' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:0710' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:0765' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:0806' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:0902' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:0981' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:0997' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:1467' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:2980' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:3170' label: cve@mitre.org - url: 'https://bugs.python.org/issue36216' label: cve@mitre.org - url: 'https://github.com/python/cpython/pull/12201' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/ label: cve@mitre.org - url: >- https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202003-26' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20190517-0001/' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4127-1/' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4127-2/' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securityfocus.com/bid/107400' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHBA-2019:0763' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHBA-2019:0764' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHBA-2019:0959' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:0710' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:0765' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:0806' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:0902' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:0981' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:0997' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:1467' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:2980' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:3170' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugs.python.org/issue36216' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/python/cpython/pull/12201' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202003-26' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20190517-0001/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4127-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4127-2/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd - cve.org - score-dispute epss: 0.08811 epssPercentile: 0.95053 ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-10-07T18:20:04.606550Z' scores: nvd: 9.8 adp: 5.3 ingestedAt: '2026-10-07T18:42:20.898Z' --- ## Overview Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. ## Affected - `python >= 2.7.0, < 2.7.17` - `python >= 3.0.0, < 3.4.10` - `python >= 3.5.0, < 3.5.7` - `python >= 3.6.0, < 3.6.9` - `python >= 3.7.0, < 3.7.3` - `fedora = 28` - `fedora = 29` - `fedora = 30` - `fedora = 31` - `leap = 15.0` - `leap = 15.1` - `leap = 42.3` - `debian_linux = 8.0` - `debian_linux = 9.0` - `ubuntu_linux = 12.04` - `ubuntu_linux = 14.04` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 19.04` - `openshift_container_platform = 3.11` - `enterprise_linux = 7.5` - `enterprise_linux = 8.0` - `enterprise_linux_desktop = 6.0` - `enterprise_linux_eus = 7.5` - `enterprise_linux_eus = 8.1` - `enterprise_linux_eus = 8.2` - `enterprise_linux_eus = 8.4` - `enterprise_linux_eus = 8.6` - `enterprise_linux_server = 6.0` - `enterprise_linux_server_aus = 7.4` - `enterprise_linux_server_aus = 8.2` - `enterprise_linux_server_aus = 8.4` - `enterprise_linux_server_eus = 5.6` - `enterprise_linux_server_tus = 7.4` - `enterprise_linux_server_tus = 8.2` - `enterprise_linux_server_tus = 8.4` - `enterprise_linux_server_tus = 8.6` - `enterprise_linux_workstation = 6.0` - `virtualization = 4.0` - `sun_zfs_storage_appliance_kit = 8.8.6` ## Remediation Upgrade past the affected range: - `python 3.7.3`