id: PYSEC-2026-1222
published: "2026-07-07T16:03:18.908634Z"
modified: "2026-07-07T17:23:51.590371Z"
aliases:
- CVE-2026-22779
- GHSA-6pw3-h7xf-x4gp
summary: BlackSheep's ClientSession is vulnerable to CRLF injection
details: "### Impact\nThe HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request.\nExploitation requires developers to pass unsanitized user input directly into headers.\nThe server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers.\n\n**Attack vector:** Applications using user input in HTTP client requests (method, URL, headers).\n\n### Patches\nUsers who use the HTTP Client in BlackSheep should upgrade to `2.4.6`.\n\n### Workarounds\nIf users handle headers from untrusted parties, they might reject values for header names and values that contain carriage returns.\n\n### References\nhttps://owasp.org/www-community/vulnerabilities/CRLF_Injection"
affected:
- package:
    name: blacksheep
    ecosystem: PyPI
    purl: pkg:pypi/blacksheep
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.4.6
  versions:
  - 0.0.1
  - 0.0.2
  - 0.0.4
  - 0.0.5
  - 0.0.6
  - 0.0.7
  - 0.0.9
  - 0.1.0
  - 0.1.1
  - 0.1.2
  - 0.1.3
  - 0.1.4
  - 0.1.5
  - 0.1.6
  - 0.1.7
  - 0.1.8
  - 0.1.9
  - 0.2.0
  - 0.2.1
  - 0.2.2
  - 0.2.3
  - 0.2.4
  - 0.2.5
  - 0.2.6
  - 0.2.7
  - 0.2.8
  - 0.2.9
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.0.6
  - 1.0.7
  - 1.0.8
  - 1.0.9
  - 1.1.0
  - 1.2.0
  - 1.2.1
  - 1.2.10
  - 1.2.11
  - 1.2.12
  - 1.2.13
  - 1.2.14
  - 1.2.15
  - 1.2.16
  - 1.2.17
  - 1.2.18
  - 1.2.19
  - 1.2.2
  - 1.2.20
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.7
  - 1.2.8
  - 1.2.9
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.0.6
  - 2.0.7
  - 2.0.8
  - 2.0a0
  - 2.0a1
  - 2.0a10
  - 2.0a11
  - 2.0a12
  - 2.0a2
  - 2.0a3
  - 2.0a4
  - 2.0a5
  - 2.0a6
  - 2.0a7
  - 2.0a8
  - 2.0a9
  - 2.1.0
  - 2.2.0
  - 2.3.0
  - 2.3.1
  - 2.3.1a1
  - 2.3.2
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.4.4a0
  - 2.4.4a2
  - 2.4.5
references:
- type: WEB
  url: https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gp
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-22779
- type: WEB
  url: https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12
- type: PACKAGE
  url: https://github.com/Neoteroi/BlackSheep
- type: WEB
  url: https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6
- type: PACKAGE
  url: https://pypi.org/project/blacksheep
- type: ADVISORY
  url: https://github.com/advisories/GHSA-6pw3-h7xf-x4gp
severity:
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N