CVE-2021-41945

Description

Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.

How to fix CVE-2021-41945

To remediate CVE-2021-41945, upgrade the affected package to a fixed version below.

• Debian/httpx—no fix listed
• PyPI/httpx—upgrade to 0.23.0 or later
• —upgrade to 0.20.0 or later

Is CVE-2021-41945 being exploited?

Low — EPSS is 0.7%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0
• from 0, < 0.23.0
• from 0, < 0.20.0

CVSS scores

References (13)

• ADVISORYgithub.com/advisories/GHSA-h8pj-cxx2-jfg2
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-41945
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-41945
• PATCHgithub.com/encode/httpx
• WEBencode.com