8 published AI models are associated with this package: 3 name it in a requirements or pyproject file, 6 load it or import it directly, and 2 are inferred from the runtime stack their declared library pulls in. Only 2 state a version requirement, so this is not a count of affected models.
cvss
7.5
high
CVSS v3.1 base score out of 10
epss
1.4%
medium
chance of exploitation in 30 days, 72nd percentile of all CVEs
xyz score
4.9
medium
CyberXYZ composite out of 10
fig. 01 — GHSA-f97h-2pfx-f59f, the advisory selected below
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
// cvss v3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Checked 2026-11-06 at 22:38 UTC. The most recent advisory here was published 2020-07-29. Updated continuously from NVD, GHSA, OSV and CNA feeds.