External risk intelligence

Python URL Parsing Security Regression Leads to Data Disclosure

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2019-10160

The vulnerability exists within the standard Python URL parsing library, which is a foundational component extensively used by developers to build web applications, APIs, and network services that process user-supplied URLs. Because this functionality is commonly integrated into internet-facing applications and edge services to handle web traffic or authentication, it has a high likelihood of being exposed to the public internet.

Python

2.7.0 to before 2.7.173.5.0 to before 3.5.83.6.0 to before 3.6.93.7.0 to before 3.7.43.8.07.07.68.09.015.015.129303112.0414.0416.0418.0419.044.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw in Python's URL parsing could allow an attacker to trick applications into sending sensitive information to unintended destinations. This issue affects how user-supplied URLs are processed, potentially exposing data such as authentication credentials or cookies. The impact on specific applications can vary.

Malicious URLs can send sensitive data elsewhere.
It's a foundational flaw affecting many applications.
Confirm relevance and exposure to sensitive data.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted URLs to applications that parse user-supplied URLs. This abuse of the URL's user and password components could cause the application to incorrectly locate and transmit sensitive host-related information, such as authentication credentials, to an unintended destination.

Unauthenticated network access required.
Specially crafted URLs trigger information leakage.
Compromise of sensitive data possible.

Live Threat

Current exploitation, exposure, and threat context

When an application processes user-supplied URLs, specially crafted URLs could cause it to send host-related information, such as authentication credentials or cookies, to an unintended destination. This behavior may vary depending on the specific application's implementation.

Application credentials or cookies.
Specially crafted URLs direct information.
Unauthorized access to sensitive data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for Python-based applications, APIs, and network services should prioritize this vulnerability. The first practical step is to identify all deployments of Python where user-supplied URLs are parsed, determine their exposure to external networks, and assess their business criticality. Once accountable owners are identified, a risk-based remediation plan can be developed, considering factors like scheduled maintenance windows and coordination with any upstream vendors.

Identify application owners, not just infrastructure.
Verify reachability and business criticality first.
Plan remediation based on exposure and impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Python software affected by CVE-2019-10160?

This CVE affects the core Python programming language, specifically its standard library responsible for parsing URLs. Developers frequently use these built-in Python libraries to build web applications, APIs, and networking tools that must interpret web addresses. Because it is a foundational component used across many different types of software and operating systems—including various Linux distributions—it serves as a common building block for network-connected services.

How does CVE-2019-10160 manipulate URL parsing?

This vulnerability is classified as a weakness in how input is neutralized and how sensitive information is handled (CWE-172 and CWE-522). It allows an attacker to craft a malicious URL containing specific user and password components that trick the underlying Python code. When an application processes this URL, the flaw causes the library to misidentify the intended destination, potentially leaking credentials or cookies to a server controlled by the attacker.

Do I need to worry if my application does not parse user URLs?

The vulnerability requires the application to actively accept and parse URLs provided by users or external sources. If your Python application does not take URL inputs from external parties and perform operations like storing cookies or managing authentication based on those inputs, it is not susceptible to this specific trigger path. The bug is strictly tied to how the library handles the user and password sections within those supplied strings.

Is CVE-2019-10160 a risk for my internet-facing services?

Yes, it is a significant consideration. According to Halo Surface Signal, because the Python URL parsing library is a foundational component integrated into many edge services and web applications that handle traffic, there is a high likelihood that affected code is exposed to the public internet. Any application reachable by external users that uses these Python functions to process URLs is considered a potential entry point for this attack.

What is the first step to address this Python vulnerability?

Your priority is to identify where your software stack relies on affected versions of Python—specifically versions 2.7, 3.5, 3.6, 3.7, and early 3.8 releases. Start by auditing your environment for these Python versions and mapping them to applications that process external URL inputs. Once identified, ensure your systems are updated to patched versions of Python, which resolve the underlying parsing regression.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.