---
id: CVE-2022-0391
title: 'A flaw was found in Python, specifically within the urllib.parse module'
summary: >-
  A flaw was found in Python, specifically within the urllib.parse module. This
  module helps break Uniform Resource Locator (URL) strings into components. The
  issue involves how the urlparse method does not sanitize input and allows
  charac…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-74
  - CWE-74
vendor: python
product: python
affected:
  - python < 3.6.14
  - 'python >= 3.7.0, < 3.7.11'
  - 'python >= 3.8.0, < 3.8.11'
  - 'python >= 3.9.0, < 3.9.5'
  - python = 3.10.0
  - active_iq_unified_manager
  - hci
  - management_services_for_element_software
  - ontap_select_deploy_administration_utility
  - 'solidfire,_enterprise_sds_&_hci_storage_node'
  - hci_compute_node
  - fedora = 34
  - fedora = 35
  - http_server = 12.2.1.3.0
  - http_server = 12.2.1.4.0
  - zfs_storage_appliance_kit = 8.8
patched:
  - python 3.9.5
published: '2022-02-09'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:17:13.947'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-0391'
references:
  - url: 'https://bugs.python.org/issue43882'
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html'
    label: secalert@redhat.com
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/
    label: secalert@redhat.com
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/
    label: secalert@redhat.com
  - url: 'https://security.gentoo.org/glsa/202305-02'
    label: secalert@redhat.com
  - url: 'https://security.netapp.com/advisory/ntap-20220225-0009/'
    label: secalert@redhat.com
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
    label: secalert@redhat.com
  - url: 'https://bugs.python.org/issue43882'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202305-02'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20220225-0009/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.08325
epssPercentile: 0.94842
ingestedAt: '2026-10-14T13:30:58.408Z'
---

## Overview

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

## Affected

- `python < 3.6.14`
- `python >= 3.7.0, < 3.7.11`
- `python >= 3.8.0, < 3.8.11`
- `python >= 3.9.0, < 3.9.5`
- `python = 3.10.0`
- `active_iq_unified_manager`
- `hci`
- `management_services_for_element_software`
- `ontap_select_deploy_administration_utility`
- `solidfire,_enterprise_sds_&_hci_storage_node`
- `hci_compute_node`
- `fedora = 34`
- `fedora = 35`
- `http_server = 12.2.1.3.0`
- `http_server = 12.2.1.4.0`
- `zfs_storage_appliance_kit = 8.8`

## Remediation

Upgrade past the affected range:

- `python 3.9.5`