CVE-2016-9964 — CRLF Injection in Bottle

CWE-93 — CRLF Injection9 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
1.2%
top 20.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Bottlepy BottleDebian Python-bottleDebian Linux
Timeline
PublishedDec 16
Latest updateJan 21

Description

redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶PyPIbottlepy/bottle0.10.1 — 0.12.11
▶debiandebian/python-bottle< python-bottle 0.12.11-1 (bookworm)
▶NVDbottlepy/bottle0.12.10

Also affects: Debian Linux 8.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
bottle.py vulnerable to CRLF Injection↗2022-05-17
▶
GHSA
bottle.py vulnerable to CRLF Injection↗2022-05-17
▶
OSV
CVE-2016-9964: redirect() in bottle↗2016-12-16
▶

📋Vendor Advisories

1
Debian
CVE-2016-9964: python-bottle - redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, whic...↗2016
▶

📄Research Papers

1
arXiv
SAGA: Detecting Security Vulnerabilities Using Static Aspect Analysis↗2026-01-21
▶

💬Community

3
Bugzilla
CVE-2016-9964 python-bottle: redirect() doesn't filter "\r\n" which allows for CRLF attack [fedora-all]↗2016-12-16
▶
Bugzilla
CVE-2016-9964 python-bottle: redirect() doesn't filter "\r\n" which allows for CRLF attack↗2016-12-16
▶
Bugzilla
CVE-2016-9964 python-bottle: redirect() doesn't filter "\r\n" which allows for CRLF attack [epel-all]↗2016-12-16
▶
CVE-2016-9964 — CRLF Injection in Bottlepy Bottle | cvebase