Every CVE Search/ Get API key

CVE-2026-44889

WebOb: Location header normalization during redirect leads to open redirect

6.1 MediumFix available

WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.27%Up 0.2 points since Jun 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

WebOb: Location header normalization during redirect leads to open redirect

WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.

Record
CVE-2026-44889
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
EUVDEUVD-2026-38391 6.1

WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.

Record
EUVD-2026-38391
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-fh3h-vg37-cc95 6.1

WebOb: Location header normalization during redirect leads to open redirect - again

Impact

When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urllib.parse, and joining it to the base URL. urlsplit (called internally by urljoin) however treats a // at the start of a string as a URI without a scheme, and then treats the next part as the hostname. urljoin will then use that hostname from the second part as the hostname replacing the original one from the request.

In a previous advisory https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3 an attempt to fix this was made by forcing the replacement of // with /%2f, however this did not take into account that since Python 3.10 urlsplit internally strips ASCII tab, carriage return, and newline characters from the string, so /\t/attacker.com gets turned into //attacker.com and the attacker is able to bypass the changes introduced in that previous advisory, thereby bringing back the problem that was attempted to be fixed.

>>> parse.urlparse("//attacker.com/some/path")
ParseResult(scheme='', netloc='attacker.com', path='/some/path', params='', query='', fragment='')

WebOb uses urljoin to take the request URI and join the redirect location to it, so assuming the request URI is https://example.org/ and the URL to redirect to is /\t/attacker.com/some/path/:

>>> parse.urljoin("https://example.org/", "/\t/attacker.com/some/path/")
'https://attacker.com/some/path/'

Which redirects from example.org where we want the user to stay to attacker.com.

Patches

This issue has been fixed in WebOb 1.8.10.

Workarounds

Any use of the Response class that includes a location can be rewritten to make sure to always pass a full URI that includes the hostname to redirect the user to, or to validate that the redirect target starts with a scheme (e.g. http:// or https://) before assigning to Response.location.

References

Thanks

  • Caleb Brown of Google
Record
GHSA-fh3h-vg37-cc95
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
NVD 6.1

WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.

Record
CVE-2026-44889
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
OSV 6.1

WebOb: Location header normalization during redirect leads to open redirect

WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.

Record
CVE-2026-44889
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
OSVDEBIAN-CVE-2026-44889 6.1

WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.

Record
DEBIAN-CVE-2026-44889
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 11 moreShow less
OSVGHSA-fh3h-vg37-cc95 6.1

WebOb: Location header normalization during redirect leads to open redirect - again

Impact

When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urllib.parse, and joining it to the base URL. urlsplit (called internally by urljoin) however treats a // at the start of a string as a URI without a scheme, and then treats the next part as the hostname. urljoin will then use that hostname from the second part as the hostname replacing the original one from the request.

In a previous advisory https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3 an attempt to fix this was made by forcing the replacement of // with /%2f, however this did not take into account that since Python 3.10 urlsplit internally strips ASCII tab, carriage return, and newline characters from the string, so /\t/attacker.com gets turned into //attacker.com and the attacker is able to bypass the changes introduced in that previous advisory, thereby bringing back the problem that was attempted to be fixed.

>>> parse.urlparse("//attacker.com/some/path")
ParseResult(scheme='', netloc='attacker.com', path='/some/path', params='', query='', fragment='')

WebOb uses urljoin to take the request URI and join the redirect location to it, so assuming the request URI is https://example.org/ and the URL to redirect to is /\t/attacker.com/some/path/:

>>> parse.urljoin("https://example.org/", "/\t/attacker.com/some/path/")
'https://attacker.com/some/path/'

Which redirects from example.org where we want the user to stay to attacker.com.

Patches

This issue has been fixed in WebOb 1.8.10.

Workarounds

Any use of the Response class that includes a location can be rewritten to make sure to always pass a full URI that includes the hostname to redirect the user to, or to validate that the redirect target starts with a scheme (e.g. http:// or https://) before assigning to Response.location.

References

Thanks

  • Caleb Brown of Google
Record
GHSA-fh3h-vg37-cc95
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
OSVOESA-2026-2679 6.1

python-webob security update

WebOb provides wrappers around the WSGI request environment, and an object to help create WSGI responses. The objects map much of the specified behavior of HTTP, including header parsing and accessors for other standard parts of the environment.

Security Fix(es):

Impact

When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urllib.parse, and joining it to the base URL. urlsplit (called internally by urljoin) however treats a // at the start of a string as a URI without a scheme, and then treats the next part as the hostname. urljoin will then use that hostname from the second part as the hostname replacing the original one from the request.

In a previous advisory https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3 an attempt to fix this was made by forcing the replacement of // with /%2f, however this did not take into account that since Python 3.10 urlsplit internally strips ASCII tab, carriage return, and newline characters from the string, so /\t/attacker.com gets turned into //attacker.com and the attacker is able to bypass the changes introduced in that previous advisory, thereby bringing back the problem that was attempted to be fixed.

>>> parse.urlparse("//attacker.com/some/path")
ParseResult(scheme='', netloc='attacker.com', path='/some/path', params='', query='', fragment='')

WebOb uses urljoin to take the request URI and join the redirect location to it, so assuming the request URI is https://example.org/ and the URL to redirect to is /\t/attacker.com/some/path/:

>>> parse.urljoin("https://example.org/", "/\t/attacker.com/some/path/")
'https://attacker.com/some/path/'

Which redirects from example.org where we want the user to stay to attacker.com.

Patches

This issue has been fixed in WebOb 1.8.10.

Workarounds

Any use of the Response class that includes a location can be rewritten to make sure to always pass a full URI that includes the hostname to redirect the user to, or to validate that the redirect target starts with a scheme (e.g. http:// or https://) before assigning to Response.location.

References

Thanks

  • Caleb Brown of Google(CVE-2026-44889)
Record
OESA-2026-2679
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVPYSEC-2026-251 6.1

WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.

Record
PYSEC-2026-251
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-44889 6.1

WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.

Record
UBUNTU-CVE-2026-44889
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVAZL-91362 No score

CVE-2026-44889 affecting package python-webob for versions less than 1.8.10-1

WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.

Record
AZL-91362
Updated
2026-11-02
OSVMGASA-2026-0452 No score

Updated python-webob packages fix a security vulnerability

Location header normalization during redirect leads to open redirect - again

Record
MGASA-2026-0452
Updated
2026-11-02
OSVopenSUSE-SU-2026:11041-1 No score

python-WebOb-doc-1.8.10-1.1 on GA media

These are all security issues fixed in the python-WebOb-doc-1.8.10-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11041-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21063-1 No score

Security update for python-Markdown, python-joblib, python-handy-archives, python-apache-libcloud, python-WebOb, python-PyGithub, python-soupsieve

This update for python-Markdown, python-joblib, python-handy-archives, python-apache-libcloud, python-WebOb, python-PyGithub, python-soupsieve fixes the following issues:

Changes in python-Markdown:

  • Fix tests with latest python version (bsc#1268243)

Changes in python-joblib:

  • Update to 1.5.2:
    • fixing the resource tracker for python 3.13.7+
    • Skip tests failing with Python 3.13.7

Changes in python-handy-archives:

  • Skip some zip64 tests that fails with latest python interpreter because there are more consistency checks in zipfile (bsc#1256310)

Changes in python-apache-libcloud:

  • Fix tests compatibility with latest Python 3.13 (bsc#1258223, bsc#1261918)

Changes in python-WebOb:

  • Security issues fixed:
    • CVE-2026-44889: Fixed: Location header normalization during redirect leads to open redirect (bsc#1268324)
  • Skip boken test with latest cpython interpreters (bsc#1258223)
  • Skip test failing on Python 3.14

Changes in python-PyGithub:

  • Fix: [SUSE:SLFO:Main] python-PyGithub fails to build on aarch64, ppc64le, s390x, x86_64 (bsc#1263802)

Changes in python-soupsieve:

  • Fix: [SUSE:SLFO:Main] python-soupsieve:test fails to build on aarch64, ppc64le, s390x, x86_64 (bsc#1256316)
Record
openSUSE-SU-2026:21063-1
Updated
2026-11-02
OSVSUSE-SU-2026:22370-1 No score

Security update for python-Markdown, python-joblib, python-handy-archives, python-apache-libcloud, python-WebOb, python-PyGithub, python-soupsieve

This update for python-Markdown, python-joblib, python-handy-archives, python-apache-libcloud, python-WebOb, python-PyGithub, python-soupsieve fixes the following issues:

Changes in python-Markdown:

  • Fix tests with latest python version (bsc#1268243)

Changes in python-joblib:

  • Update to 1.5.2:
    • fixing the resource tracker for python 3.13.7+
    • Skip tests failing with Python 3.13.7

Changes in python-handy-archives:

  • Skip some zip64 tests that fails with latest python interpreter because there are more consistency checks in zipfile (bsc#1256310)

Changes in python-apache-libcloud:

  • Fix tests compatibility with latest Python 3.13 (bsc#1258223, bsc#1261918)

Changes in python-WebOb:

  • Security issues fixed:
    • CVE-2026-44889: Fixed: Location header normalization during redirect leads to open redirect (bsc#1268324)
  • Skip boken test with latest cpython interpreters (bsc#1258223)
  • Skip test failing on Python 3.14

Changes in python-PyGithub:

  • Fix: [SUSE:SLFO:Main] python-PyGithub fails to build on aarch64, ppc64le, s390x, x86_64 (bsc#1263802)

Changes in python-soupsieve:

  • Fix: [SUSE:SLFO:Main] python-soupsieve:test fails to build on aarch64, ppc64le, s390x, x86_64 (bsc#1256316)
Record
SUSE-SU-2026:22370-1
Updated
2026-11-02
OSVSUSE-SU-2026:2982-1 No score

Security update for python-WebOb

This update for python-WebOb fixes the following issue

  • CVE-2026-44889: Location header normalization during redirect leads to open redirect (bsc#1268324).
Record
SUSE-SU-2026:2982-1
Updated
2026-11-02
OSVUSN-8759-1 No score

python-webob vulnerabilities

It was discovered that WebOb incorrectly handled certain URLs. An attacker could possibly use this issue to control a redirect or forward to another URL. This issue was only addressed in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-42353)

Caleb Brown discovered that WebOb incorrectly handled certain URLs. An attacker could possibly use this issue to control a redirect or forward to another URL. (CVE-2026-44889)

Record
USN-8759-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
webob
PyPI
 through 1.8.9
1.8.10
python-webob
Azure Linux:3
 before 1.8.10-1
1.8.10-1
python-webob
Debian:12
 All versions, plus listed versions
1:1.8.10-11:1.8.11-11:1.8.6-31:1.8.7-11:1.8.7-21:1.8.7-31:1.8.9-11:1.8.9-2
 None known
python-webob
Debian:13
 before 1:1.8.10-0+deb13u1, plus listed versions
1:1.8.9-11:1.8.9-2
1:1.8.10-0+deb13u1
python-webob
Debian:14
 before 1:1.8.10-1, plus listed versions
1:1.8.9-11:1.8.9-2
1:1.8.10-1
webob
PyPI
 before 1.8.10, plus listed versions
0.80.8.10.8.20.8.30.8.4
Show 45 moreShow less
0.8.50.90.9.10.9.20.9.30.9.40.9.50.9.60.9.6.10.9.70.9.7.10.9.81.01.0.11.0.21.0.31.0.41.0.51.0.61.0.71.0.81.11.1.11.1b21.1beta11.1rc11.21.2.11.2.21.2.31.2b11.2b21.2b31.2rc11.31.3.11.41.4.11.4.21.5.01.5.0a01.5.0a11.5.0b01.5.11.6.0
1.8.10
python-webob
Mageia:10
 before 1.8.11-1.mga10
1.8.11-1.mga10
python-webob
Mageia:9
 before 1.8.11-1.mga9
1.8.11-1.mga9
python-webob
openEuler:22.03-LTS-SP4
 before 1.8.7-4.oe2203sp4
1.8.7-4.oe2203sp4
python-webob
openEuler:24.03-LTS-SP1
 before 1.8.7-5.oe2403sp1
1.8.7-5.oe2403sp1
Show 37 moreShow less
Affected packages
PackageAffectedFixed
python-webob
openEuler:24.03-LTS-SP3
 before 1.8.7-5.oe2403sp3
1.8.7-5.oe2403sp3
python-webob
openEuler:20.03-LTS-SP4
 before 1.8.2-5.oe2003sp4
1.8.2-5.oe2003sp4
python-Markdown
SUSE:Linux Enterprise Server 16.0
 before 3.8.2-160000.3.1
3.8.2-160000.3.1
python-PyGithub
SUSE:Linux Enterprise Server 16.0
 before 2.6.1-160000.3.1
2.6.1-160000.3.1
python-WebOb
SUSE:Linux Enterprise Server 16.0
 before 1.8.9-160000.3.1
1.8.9-160000.3.1
python-apache-libcloud
SUSE:Linux Enterprise Server 16.0
 before 3.8.0-160000.3.1
3.8.0-160000.3.1
python-handy-archives
SUSE:Linux Enterprise Server 16.0
 before 0.2.0-160000.3.1
0.2.0-160000.3.1
python-soupsieve
SUSE:Linux Enterprise Server 16.0
 before 2.6-160000.3.1
2.6-160000.3.1
python-Markdown
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 3.8.2-160000.3.1
3.8.2-160000.3.1
python-PyGithub
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.6.1-160000.3.1
2.6.1-160000.3.1
python-WebOb
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.8.9-160000.3.1
1.8.9-160000.3.1
python-apache-libcloud
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 3.8.0-160000.3.1
3.8.0-160000.3.1
python-handy-archives
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 0.2.0-160000.3.1
0.2.0-160000.3.1
python-soupsieve
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.6-160000.3.1
2.6-160000.3.1
python-WebOb
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.7.4-150000.3.6.1
1.7.4-150000.3.6.1
python-WebOb
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 1.7.4-150000.3.6.1
1.7.4-150000.3.6.1
python-webob
Ubuntu:Pro:16.04:LTS
 before 1.5.1-1ubuntu0.1~esm2, plus listed versions
1.4.1-11.5.1-1
1.5.1-1ubuntu0.1~esm2
python-webob
Ubuntu:Pro:18.04:LTS
 before 1:1.7.3-2ubuntu0.1~esm2, plus listed versions
1:1.7.2-0ubuntu11:1.7.3-0ubuntu11:1.7.3-2fakesync1
1:1.7.3-2ubuntu0.1~esm2
python-webob
Ubuntu:Pro:20.04:LTS
 before 1:1.8.5-2ubuntu0.1+esm1, plus listed versions
1:1.8.5-11:1.8.5-1build11:1.8.5-21:1.8.5-2ubuntu0.1
1:1.8.5-2ubuntu0.1+esm1
python-webob
Ubuntu:22.04:LTS
 before 1:1.8.6-1.1ubuntu0.2, plus listed versions
1:1.8.6-1.11:1.8.6-1.1ubuntu0.1
1:1.8.6-1.1ubuntu0.2
python-webob
Ubuntu:24.04:LTS
 before 1:1.8.7-1ubuntu0.1.24.04.2, plus listed versions
1:1.8.6-31:1.8.7-11:1.8.7-1ubuntu0.1.24.04.1
1:1.8.7-1ubuntu0.1.24.04.2
python-webob
Ubuntu:25.10
 All versions, plus listed versions
1:1.8.9-1
 None known
python-webob
Ubuntu:26.04:LTS
 before 1:1.8.9-1ubuntu0.1, plus listed versions
1:1.8.9-1
1:1.8.9-1ubuntu0.1
python-webob
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 1.5.1-1ubuntu0.1~esm2, plus listed versions
1.4.1-11.5.1-1
1.5.1-1ubuntu0.1~esm2
python-webob
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
 before 1:1.7.3-2ubuntu0.1~esm2, plus listed versions
1:1.7.2-0ubuntu11:1.7.3-0ubuntu11:1.7.3-2fakesync1
1:1.7.3-2ubuntu0.1~esm2
python-webob
Ubuntu:Pro:20.04:LTS
From an advisory covering 2 CVEs
 before 1:1.8.5-2ubuntu0.1+esm1, plus listed versions
1:1.8.5-11:1.8.5-1build11:1.8.5-21:1.8.5-2ubuntu0.1
1:1.8.5-2ubuntu0.1+esm1
python-webob
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 1:1.8.6-1.1ubuntu0.2, plus listed versions
1:1.8.6-1.11:1.8.6-1.1ubuntu0.1
1:1.8.6-1.1ubuntu0.2
python-webob
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 1:1.8.7-1ubuntu0.1.24.04.2, plus listed versions
1:1.8.6-31:1.8.7-11:1.8.7-1ubuntu0.1.24.04.1
1:1.8.7-1ubuntu0.1.24.04.2
python-webob
Ubuntu:26.04:LTS
From an advisory covering 2 CVEs
 before 1:1.8.9-1ubuntu0.1, plus listed versions
1:1.8.9-1
1:1.8.9-1ubuntu0.1
python-WebOb
openSUSE:Tumbleweed
 before 1.8.10-1.1
1.8.10-1.1
python-Markdown
openSUSE:Leap 16.0
 before 3.8.2-160000.3.1
3.8.2-160000.3.1
python-PyGithub
openSUSE:Leap 16.0
 before 2.6.1-160000.3.1
2.6.1-160000.3.1
python-WebOb
openSUSE:Leap 16.0
 before 1.8.9-160000.3.1
1.8.9-160000.3.1
python-apache-libcloud
openSUSE:Leap 16.0
 before 3.8.0-160000.3.1
3.8.0-160000.3.1
python-handy-archives
openSUSE:Leap 16.0
 before 0.2.0-160000.3.1
0.2.0-160000.3.1
python-joblib
openSUSE:Leap 16.0
 before 1.5.2-160000.1.1
1.5.2-160000.1.1
python-soupsieve
openSUSE:Leap 16.0
 before 2.6-160000.3.1
2.6-160000.3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-44889 is a medium vulnerability (CVSS 6.1) in Pylons Webob, published June 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in webob 1.8.10.

References

Show 22 moreShow less
This page doesn't list everything

Left out here: 23 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open