Vulnerability · Published Jan 14, 2026 · Assigned by GitHub_M
CVE-2026-22779BlackSheep ClientSession is vulnerable to CRLF injection
Medium 6.3
In plain English
A medium-severity security flaw in BlackSheep from Neoteroi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request. Exploitation requires developers to pass unsanitized user input directly into headers.The server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers. This vulnerability is fixed in 2.4.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | blacksheep | 2.4.6 | GHSA-6pw3-h7xf-x4gp |
| PyPI | blacksheep | 2.4.6 | PYSEC-2026-1222 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Neoteroi | BlackSheep | < 2.4.6 |
Weakness: CWE-113 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N