CVE-2026-44889

A flaw was found in WebOb, a library for HTTP requests and responses. A remote attacker could exploit this vulnerability by influencing the HTTP Location header during a redirect. Due to improper normalization of the Location header, specifically how certain ASCII characters are handled, an attacker can cause a user to be redirected to an arbitrary external website instead of the intended destination. This open redirect vulnerability can lead to information disclosure and impact the integrity of user sessions.

This is rated as Moderate (CVSS 6.1) because exploitation requires user interaction — a victim must click a crafted link that triggers the redirect (UI:R). While the attack is network-accessible (AV:N) and requires no privileges (PR:N), the impact is limited to low confidentiality and integrity effects typical of an open redirect (phishing, session misdirection), with no availability impact. Critically, this vulnerability is only exploitable on Python 3.10 or later, where urllib.parse.urlsplit strips tab, carriage return, and newline characters before parsing. All Red Hat product streams that ship python-webob — including Red Hat OpenShift Container Platform, Red Hat OpenStack Platform, Red Hat Ceph Storage, and Red Hat Quay — use Python 3.9 or earlier as the platform runtime, and are therefore not affected. Fedora and EPEL ship python-webob under Python 3.12+ and are affected. Users running WebOb on Python 3.10+ should upgrade to version 1.8.10, or validate that redirect targets include an explicit scheme with the expected host before assigning to Response.location.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This vulnerability in WebOb is only exploitable when running under Python 3.10 or later, where urllib.parse.urlsplit strips ASCII tab, carriage return, and newline characters before parsing. Red Hat Enterprise Linux, OpenShift Container Platform, Red Hat OpenStack Platform, Red Hat Ceph Storage, and Red Hat Quay all ship python-webob with Python 3.9 or earlier as the platform Python runtime, and are therefore not affected by this vulnerability. Fedora and EPEL ship python-webob under Python 3.12+, where the vulnerability is exploitable. Users running WebOb on Python 3.10+ should upgrade to WebOb 1.8.10. As a workaround, applications can validate that redirect targets start with a scheme (e.g. http:// or https://) and the expected host before assigning to Response.location.