python-WebOb-doc-1.8.11-1.1 on GA media (moderate)

python-WebOb-doc-1.8.11-1.1 on GA media Announcement ID: openSUSE-SU-2026:11864-1 Rating: moderate Cross-References: CVE-2026-54770 CVSS scores: CVE-2026-54770 SUSE : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerability ca...

CVE-2026-54770

creationtimestamp| type| source ---|---|--- 2026-08-27 23:33:29+00:00| seen| https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187 2026-08-28 00:01:48+00:00| seen| https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187 2026-08-28 00:35:03+00:00| published-proof-of-concept|...

academlo (>=0.0.1, <=0.0.3), aframeuz (>=0.1.0, <=0.2.0) +170 more potentially affected by CVE-2026-54770 via webob (>=1.2.3, <=1.8.10)

webob PYPI version =1.2.3, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.0.4 and more Source cves: CVE-2026-54770 Source advisory: GHSA-6HX8-3WJJ-GR8G...

academlo (>=0.0.1, <=0.0.3), aframeuz (>=0.1.0, <=0.2.0) +170 more potentially affected by CVE-2026-54770 via webob (>=1.2.3, <=1.8.10)

webob PYPI version =1.2.3, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.0.4 and more Source cves: CVE-2026-54770 Source advisory: OSV:GHSA-6HX8-3WJJ-GR8G...

academlo (>=0.0.1, <=0.0.3), aframeuz (>=0.1.0, <=0.2.0) +170 more potentially affected by CVE-2026-54770 via webob (>=1.2.3, <=1.8.10)

webob PYPI version =1.2.3, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.0.4 and more Source cves: CVE-2026-54770 Source advisory: MEND:CVE-2026-54770...

CVE-2026-54770 WebOb: Open redirect in Location header normalization via leading C0 control / space characters

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response.makelocationabsolute in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin strips leading C0 control characters and spaces. An attacker-controlled valu...