CVE-2026-44889 Details
Description
WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.
A vulnerability allowing open redirects has been identified in WebOb versions through 1.8.9. The issue arises during the normalization of the HTTP Location header for redirects. WebOb uses Python's urljoin to combine the redirect target with the request URI. However, since Python 3.10, urlsplit removes certain ASCII characters before parsing, an attacker can exploit this by including such characters in the redirect target. This manipulation can create a protocol-relative URL that redirects to an attacker-controlled site, bypassing a previous fix for a similar issue. The vulnerability is present in the response class when the location header is set without a full URI, allowing for redirection to unintended external sites.
Users can upgrade to WebOb version 1.8.10 or later to address this vulnerability. Alternatively, ensure that any Location header set in the Response class includes a full URI with the hostname or validate that the redirect target starts with a proper scheme before assigning it to the Response.location header.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Pylons/webob/security/advisories/GHSA-fh3h-vg37-cc95 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pylonsproject webob | < 1.8.10 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |