Most recent entries from all

CVE-2016-9964

2026-10-04T14:37:16.554409+00:00

redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

GHSA-j6f7-hghw-g437 — bottle.py vulnerable to CRLF Injection

2026-10-04T14:37:16.554567+00:00

Affected: PyPI: bottle

bottle.py is a fast and simple micro-framework for python web-applications. redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

PYSEC-2016-24

2026-10-04T14:37:16.554628+00:00

Affected: PyPI: bottle

redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.