CVE-2020-7695
HTTP Response Splitting
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
HTTP Response Splitting
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
- Record
CVE-2020-7695- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C - Updated
- 2026-11-02
EUVDEUVD-2020-0233
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
- Record
EUVD-2020-0233- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f97h-2pfx-f59f
HTTP response splitting in uvicorn
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
- Record
GHSA-f97h-2pfx-f59f- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
NVD
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
- Record
CVE-2020-7695- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
- Record
CVE-2020-7695- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-7695
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
- Record
DEBIAN-CVE-2020-7695- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-f97h-2pfx-f59f
HTTP response splitting in uvicorn
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
- Record
GHSA-f97h-2pfx-f59f- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-7695
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
- Record
UBUNTU-CVE-2020-7695- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2025-1755475972 No score
TuxCare security update for uvicorn (2 CVEs)
TuxCare rebuilt uvicorn to address 2 CVEs. Fixed in 0.11.6.post1+tuxcare.
- Record
CLSA-2025-1755475972- Updated
- 2026-11-02
OSVPYSEC-2020-151 No score
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
- Record
PYSEC-2020-151- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
uvicornPyPI |
before 0.11.7 | 0.11.7 |
uvicornTuxCare:PyPI From an advisory covering 2 CVEs |
0.11.6 up to 0.11.6.post1+tuxcare | 0.11.6.post1+tuxcare |
python-uvicornDebian:12 |
before 0.13.3-1 | 0.13.3-1 |
python-uvicornDebian:13 |
before 0.13.3-1 | 0.13.3-1 |
python-uvicornDebian:14 |
before 0.13.3-1 | 0.13.3-1 |
uvicornPyPI |
before 0.11.7, plus listed versions 0.0.10.0.100.0.110.0.120.0.13 Show 45 moreShow less0.0.140.0.150.0.20.0.30.0.40.0.50.0.60.0.70.0.80.0.90.1.00.1.10.10.00.10.10.10.20.10.30.10.40.10.50.10.60.10.70.10.80.10.90.11.00.11.10.11.20.11.30.11.40.11.50.11.60.2.00.2.10.2.100.2.110.2.120.2.130.2.140.2.150.2.160.2.170.2.180.2.190.2.20.2.200.2.210.2.22 |
0.11.7 |
uvicornPyPI |
before 0.11.7, plus listed versions 0.0.10.0.20.0.30.0.40.0.5 Show 45 moreShow less0.0.60.0.70.0.80.0.90.0.100.0.110.0.120.0.130.0.140.0.150.1.00.1.10.2.00.2.10.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.2.100.2.110.2.120.2.130.2.140.2.150.2.160.2.170.2.180.2.190.2.200.2.210.2.220.3.00.3.10.3.20.3.30.3.40.3.50.3.60.3.70.3.80.3.9 |
0.11.7 |
python-uvicornUbuntu:20.04:LTS |
All versions, plus listed versions 0.3.24-10.11.1-10.11.2-10.11.3-1 |
None known |
python-uvicornUbuntu:22.04:LTS |
All versions, plus listed versions 0.13.3-10.15.0-2ubuntu1 |
None known |
python-uvicornUbuntu:24.04:LTS |
All versions, plus listed versions 0.23.2+dfsg-10.24.0-1build10.25.0-10.26.0-10.27.0-10.27.1-1 |
None known |
python-uvicornUbuntu:25.10 |
All versions, plus listed versions 0.32.0-3 |
None known |
python-uvicornUbuntu:26.10 |
All versions, plus listed versions 0.38.0-1 |
None known |
python-uvicornUbuntu:26.04:LTS |
All versions, plus listed versions 0.32.0-30.38.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7695 is a medium vulnerability (CVSS 5.3) in Encode Uvicorn, published July 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in uvicorn 0.11.7.
References
github.com/encode/uvicorn
snyk.io/vuln/SNYK-PYTHON-UVICORN-570471
nvd.nist.gov/vuln/detail/CVE-2020-7695
security-tracker.debian.org/tracker/CVE-2020-7695
ubuntu.com/security/CVE-2020-7695
cve.org/CVERecord?id=CVE-2020-7695
Left out here: 134 versions. The JSON record has them.