CVE-2016-5699

Exploitation likely. EPSS gives it a 9.9% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.06.1Medium EPSS percentile95th9.9% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2016-09-02Updated 2026-05-06Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

PythonAffected: ≤ 2.7.9Upgrade to: after 2.7.9Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether any application uses Python before 2.7.10 or 3.4.4 and passes customer- or URL-supplied values to HTTP request headers.
Upgrade Python 2 installations to 2.7.10 or later, or Python 3 installations to 3.4.4 or later.
If an upgrade must wait, block carriage-return and newline characters in any untrusted value used to build request headers.
Test affected integrations to confirm their outgoing web requests still work normally after the update.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

In plain language

Written by AI from the record

This affects Python versions before 2.7.10 or 3.4.4 only when an application sends untrusted link data in web-request headers; most small businesses should update old Python installations but do not need to treat it as an emergency.

CRLF injection in CPython urllib/urllib2 HTTPConnection.putheader permits attacker-controlled carriage-return/newline sequences to add arbitrary outbound HTTP request headers when unsanitized input reaches the function.

If you're affected

Altered outbound web requests
Unauthorized request headers
Third-party service confusion
Potential data-routing errors

What is it

This flaw can let a maliciously crafted link add extra instructions to a web request sent by a vulnerable application. It is like someone slipping an extra note into an envelope after your business has addressed it, potentially changing how the receiving service handles the request.

Who is affected

This matters to you if you run an application built on Python that creates outgoing web requests. It is only a risk when untrusted data containing special line-break characters is passed directly into the request-header function.

How urgent is it

There is no record of attackers actively exploiting this issue, and no public exploit code is on record. Treat it as routine maintenance: address it when reviewing old Python systems, with priority for applications that handle links or other outside input.

What to do — in detail

Inventory deployed Python runtimes and application dependencies, then search for calls to HTTPConnection.putheader or code that builds outbound request headers from URLs, form fields, redirects, or other untrusted input.
Upgrade affected Python 2 deployments to 2.7.10 or later and affected Python 3 deployments to 3.4.4 or later. Plan a broader migration away from Python 2 if it remains in use, since it is obsolete.
Validate application compatibility in a test environment, especially outbound integrations that construct custom headers.
If patching is delayed, reject or remove \r and \n from all untrusted values before they reach header construction, and avoid passing untrusted data directly to putheader.
Review outbound-request and integration error logs for unexpected headers or failed requests after remediation. CVE-2016-5699 is not listed in CISA KEV, so there is no CISA remediation due date.

Technical context

CVE-2016-5699 is CVSS 6.1 (Medium), CWE-113 HTTP header injection, with network attack vector, no authentication requirement, and required user interaction. Exploitation requires a vulnerable CPython runtime plus application code that sends attacker-controlled CRLF sequences to HTTPConnection.putheader. It is not in CISA KEV and no public exploit code is recorded. EPSS predicts a 9.9% likelihood and is falling; this is a prediction, not evidence of active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

9.9% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

28 events over 3673 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → lowepss band change
2026-09-21EPSS band changelow → moderateepss band change
2026-09-06EPSS band changemoderate → lowepss band change
2026-09-05EPSS band changelow → moderateepss band change
2026-08-31EPSS band changemoderate → lowepss band change
2026-08-29EPSS band changelow → moderate

Affected products

pythonoss-project · US
- pythonLibraryLibraryOSS Libraries

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Scored 6.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact

Weaknesses

CWE-113No name in the record

Sources

References in the record

And 16 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Python, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account