CVE-2023-24329

HIGH 7.5EPSS 20.5%

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

CVSS v3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 20.46% chance of exploitation in the next 30 days, 97th percentile
Published: 2023-02-17
Updated: 2025-11-03

Proof-of-concept exploits (3)

H4R335HR/CVE-2023-24329-PoC0★ · 2023-08-17
Pandante-Central/CVE-2023-24329-codeql-test0★ · 2023-08-18
PenTestMano/CVE-2023-24329-Exploit0★ · 2023-10-13

References

Related