PYSEC-2026-3943 WebOb: Open redirect in Location header normalization via leading C0 control / space characters

🗓️ 10 Sep 2026 09:44:57Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Open redirect in WebOb Location header via leading C0 control or space bypassing guard checks.

Reporter	Title	Published	Views	Family All 82
BDU FSTEC	The vulnerability of the `Response._make_location_absolute()` function in the `src/webob/response.py` file of the WebOb library, which is used for analyzing HTTP requests and generating HTTP responses. This vulnerability allows attackers to carry out phishing attacks.	26 Aug 202600:00	–	bdu_fstec
CBLMariner	CVE-2026-54770 affecting package python-webob for versions less than 1.8.11-1	25 Aug 202623:52	–	cbl_mariner
Chainguard	CVE-2026-54770 vulnerabilities	29 Aug 202608:26	–	cgr
Circl	CVE-2026-54770	27 Aug 202623:33	–	circl
CVE	CVE-2026-54770	20 Aug 202616:31	–	cve
Cvelist	CVE-2026-54770 WebOb: Open redirect in Location header normalization via leading C0 control / space characters	20 Aug 202616:31	–	cvelist
Debian CVE	CVE-2026-54770	20 Aug 202616:31	–	debiancve
EUVD	EUVD-2026-63467	27 Aug 202622:10	–	euvd
Github Security Blog	WebOb: Open redirect in Location header normalization via leading C0 control / space characters	27 Aug 202622:10	–	github
NVD	CVE-2026-54770	20 Aug 202617:18	–	nvd

Source	Link
github	www.github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54770
github	www.github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07
github	www.github.com/Pylons/webob
github	www.github.com/Pylons/webob/tree/1.8.11
pypi	www.pypi.org/project/webob
github	www.github.com/advisories/GHSA-6hx8-3wjj-gr8g

10 Sep 2026 12:15Current

CVSS 3.16.1

EPSS0.00339

WebOb open redirect Location header C0 control characters urljoin Python