Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-24329

35
FAUCET Score

CVE-2023-24329 is a high-severity vulnerability (CVSS 7.5) affecting the urllib.parse component in Python versions prior to 3.11.4, as well as products from fedoraproject and netapp. Attackers can bypass URL blocklisting methods by prepending blank characters to a URL, leading to potential integrity impacts. While no active exploitation or public exploit code is currently known, and community discussion is minimal, organizations using affected Python versions should prioritize patching to mitigate this risk.

Impacted Technologies

VendorProductVersion(s)CPE
< 3.7.17CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.8.0, < 3.8.17CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.9.0, < 3.9.17CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.10.0, < 3.10.12CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.11.0, < 3.11.4CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
20.46%
Probability of exploitation in next 30 days
EPSS Percentile
97.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.2046 is in the 96th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (63)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: cbl2 python3 3.9.14-8 on CBL Mariner 2.0Fixed in: 3.9.14-8
microsoftpatch availablevia msrc
Product: 17947-16820Fixed in: 2.7.18-12
microsoftpatch availablevia msrc
Product: 17948-16820Fixed in: 3.7.13-6
microsoftpatch availablevia msrc
Product: 17949-16823Fixed in: 3.9.14-8
microsoftpatch availablevia msrc
Product: cm1 python2 2.7.18-12 on CBL Mariner 1.0Fixed in: 2.7.18-12
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 3.9.14-8
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 3.9.14-8
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 3.7.13-6
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 2.7.18-12
microsoftpatch availablevia msrc
Product: cm1 python3 3.7.13-6 on CBL Mariner 1.0Fixed in: 3.7.13-6
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 3.7.13-6
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 2.7.18-12
nodejspatch availablevia llm_extracted
View patch
pjsippatch availablevia llm_extracted
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: python38:3.8-8020020230628091203.8c0020b9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Telecommunications Update ServiceFixed in: python27:2.7-8020020230614130117.c9f5743f
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Telecommunications Update ServiceFixed in: python3-0:3.6.8-24.el8_2.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Telecommunications Update ServiceFixed in: python38:3.8-8020020230628091203.8c0020b9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Update Services for SAP SolutionsFixed in: python27:2.7-8020020230614130117.c9f5743f
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Update Services for SAP SolutionsFixed in: python3-0:3.6.8-24.el8_2.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Update Services for SAP SolutionsFixed in: python38:3.8-8020020230628091203.8c0020b9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: python27:2.7-8040020230613113051.7c6da464
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: python3-0:3.6.8-39.el8_4.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: python39:3.9-8040020230614130711.63cd9eba
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: python38:3.8-8040020230626111739.6dfe838a
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: python27:2.7-8040020230613113051.7c6da464
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: python3-0:3.6.8-39.el8_4.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: python39:3.9-8040020230614130711.63cd9eba
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: python38:3.8-8040020230626111739.6dfe838a
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: python27:2.7-8040020230613113051.7c6da464
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: python3-0:3.6.8-39.el8_4.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: python39:3.9-8040020230614130711.63cd9eba
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: python38:3.8-8040020230626111739.6dfe838a
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: python39:3.9-8060020230614130816.6a631399
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: python39-devel:3.9-8060020230614130816.6a631399
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: python3-0:3.6.8-47.el8_6.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: python27:2.7-8060020230612150703.2aa69ce4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: python38:3.8-8060020230627164849.e505919a
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: python38-devel:3.8-8060020230627164849.e505919a
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: python3.11-0:3.11.2-2.el9_2.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: python3.9-0:3.9.16-1.el9_2.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python38-python-0:3.8.18-2.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8Fixed in: redhat-virtualization-host-0:4.5.3-202307191258_8.6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.0 Extended Update SupportFixed in: python3.9-0:3.9.10-4.el9_0.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6 Extended Lifecycle SupportFixed in: python-0:2.6.6-69.el6_10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: python-0:2.7.5-93.el7_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: python3-0:3.6.8-19.el7_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python3-0:3.6.8-51.el8_8.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python3.11-0:3.11.2-2.el8_8.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python27:2.7-8080020230609134836.392b0bf1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python38:3.8-8080020230531142020.a822e92f
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python38-devel:3.8-8080020230531142020.a822e92f
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python39:3.9-8080020230531142208.93c2fc2f
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python39-devel:3.9-8080020230531142208.93c2fc2f
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: python27:2.7-8010020230614130243.208b345f
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: python3-0:3.6.8-15.1.el8_1.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: python27:2.7-8020020230614130117.c9f5743f
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: python3-0:3.6.8-24.el8_2.1
View patch
zimbrapatch availablevia llm_extracted
Fixed in: 9.0.7, 9.1.2
zimbrapatch availablevia llm_extracted
Fixed in: 9.1.2308.100
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: inkscape:flatpak/python2
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: gimp:flatpak/python2

Vendor Advisories (7)

nodejsllm-nodejs-302528ae26f0d946CRITICAL

HP ThinPro 8.1 SP4 Security Updates

Oct 29, 2024
pjsipllm-pjsip-7ba3ec379210ac70CRITICAL

HP ThinPro 8.1 SP4 Security Updates

Oct 29, 2024
zimbrallm-zimbra-fd444cd12d805adaCRITICAL

November 2023 Third-Party Package Updates in Splunk Cloud Platform

Nov 16, 2023
zimbrallm-zimbra-eff41b993417b303HIGH

November 2023 Third Party Package updates in Splunk Enterprise

Nov 16, 2023
microsoft2023-Oct/CVE-2023-24329

CVE-2023-24329

Oct 10, 2023
redhatCVE-2023-24329Important

python: urllib.parse url blocklisting bypass

Feb 17, 2023
microsoft2023-Feb/CVE-2023-24329Important

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Feb 14, 2023

References

lists.debian.org / debian-lts-announce/2024/11/msg00005.html
lists.debian.org / debian-lts-announce/2024/12/msg00000.html
github.com / python/cpython/issues/102153
Issue Tracking
github.com / python/cpython/pull/99421
Patch
lists.debian.org / debian-lts-announce/2023/09/msg00022.html
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU
pointernull.com / security/python-url-parse-problem.html
ExploitMitigationTechnical DescriptionThird Party Advisory
security.netapp.com / advisory/ntap-20230324-0004
Third Party Advisory
kb.cert.org / vuls/id/127587