An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that start

Summary

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Timeline

1. Feb 17, 2023, 12:00 AM UTCCVE published
2. Mar 18, 2025, 4:25 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 14, 2026, 10:32 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• libpythonBitnami

  fixed in 3.7.17; From 3.8.0 · fixed in 3.8.17; From 3.9.0 · fixed in 3.9.17; From 3.10.0 · fixed in 3.10.12; From 3.11.0 · fixed in 3.11.4

• pythonBitnami

  fixed in 3.7.17; From 3.8.0 · fixed in 3.8.17; From 3.9.0 · fixed in 3.9.17; From 3.10.0 · fixed in 3.10.12; From 3.11.0 · fixed in 3.11.4

• python-minBitnami

  fixed in 3.7.17; From 3.8.0 · fixed in 3.8.17; From 3.9.0 · fixed in 3.9.17; From 3.10.0 · fixed in 3.10.12; From 3.11.0 · fixed in 3.11.4

References 25