python-WebOb-doc-1.8.11-1.1 on GA media (moderate)

python-WebOb-doc-1.8.11-1.1 on GA media Announcement ID: openSUSE-SU-2026:11864-1 Rating: moderate Cross-References: CVE-2026-54770 CVSS scores: CVE-2026-54770 SUSE : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerability ca...

CVE-2026-54770

creationtimestamp| type| source ---|---|--- 2026-08-27 23:33:29+00:00| seen| https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187 2026-08-28 00:01:48+00:00| seen| https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187 2026-08-28 00:35:03+00:00| published-proof-of-concept|...

CVE-2026-54770 WebOb: Open redirect in Location header normalization via leading C0 control / space characters

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response.makelocationabsolute in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin strips leading C0 control characters and spaces. An attacker-controlled valu...