CVE-2019-9636

29

FAUCET Score

CVE-2019-9636 describes an improper handling of Unicode encoding during NFKC normalization in Python's urllib.parse.urlsplit and urllib.parse.urlparse components, affecting Python versions 2.7.x through 2.7.16 and 3.x through 3.7.2. This critical vulnerability (CVSS 9.8) allows a specially crafted URL to be incorrectly parsed, leading to information disclosure such as credentials or cookies being sent to an unintended host. While the attack vector is network-based with low complexity, there is currently no public exploit code available (Metasploit, Nuclei, ExploitDB) and minimal community discussion or media coverage. This vulnerability is fixed in Python versions 2.7.17, 3.5.7+, 3.6.9+, and 3.7.3+.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.7.0, < 2.7.17CPE matchmatch criteria	cpe:2.3:a:python:python::::::::
		>= 3.0.0, < 3.4.10CPE matchmatch criteria	cpe:2.3:a:python:python::::::::
		>= 3.5.0, < 3.5.7CPE matchmatch criteria	cpe:2.3:a:python:python::::::::
		>= 3.6.0, < 3.6.9CPE matchmatch criteria	cpe:2.3:a:python:python::::::::
		>= 3.7.0, < 3.7.3CPE matchmatch criteria	cpe:2.3:a:python:python::::::::

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

9.13%

Probability of exploitation in next 30 days

EPSS Percentile

94.8%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0912 is in the 90th percentile among its peer group of 36,862 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (29)

github_advisorypatch availablevia nvd_reference

nodejspatch availablevia llm_extracted

pjsippatch availablevia llm_extracted

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7.4 Advanced Update SupportFixed in: python-0:2.7.5-59.el7_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7.4 Telco Extended Update SupportFixed in: python-0:2.7.5-59.el7_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7.4 Update Services for SAP SolutionsFixed in: python-0:2.7.5-59.el7_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7.5 Extended Update SupportFixed in: python-0:2.7.5-70.el7_5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: python27:2.7-8000020190410132513.c0efe978

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: python3-0:3.6.8-2.el8_0

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-python36-python-0:3.6.3-4.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: python27-python-0:2.7.13-4.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-python35-python-0:3.5.1-12.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python36-python-0:3.6.3-7.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-python-0:2.7.13-6.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python35-python-0:3.5.1-12.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-python36-python-0:3.6.3-7.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: python27-python-0:2.7.13-6.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-python35-python-0:3.5.1-12.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-python36-python-0:3.6.3-7.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: python27-python-0:2.7.13-6.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-python35-python-0:3.5.1-12.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-python36-python-0:3.6.3-7.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: python27-python-0:2.7.13-6.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-python35-python-0:3.5.1-12.el7

redhatpatch availablevia redhat_api

Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: redhat-release-virtualization-host-0:4.2-8.4.el7

redhatpatch availablevia redhat_api

Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: redhat-virtualization-host-0:4.2-20190411.1.el7_6

redhatpatch availablevia redhat_api

Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: rhvm-appliance-0:4.2-20190411.1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: python-0:2.7.5-77.el7_6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: python-0:2.6.6-68.el6_10

Vendor Advisories (3)

nodejsllm-nodejs-302528ae26f0d946CRITICAL

HP ThinPro 8.1 SP4 Security Updates

pjsipllm-pjsip-7ba3ec379210ac70CRITICAL

HP ThinPro 8.1 SP4 Security Updates

redhatCVE-2019-9636Important

python: Information Disclosure due to urlsplit improper NFKC normalization

References

lists.opensuse.org / opensuse-security-announce/2019-04/msg00092.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2019-04/msg00097.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2019-05/msg00024.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2019-06/msg00050.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2019-08/msg00042.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2020-01/msg00040.html

Mailing ListThird Party Advisory

access.redhat.com / errata/RHBA-2019:0763

Third Party Advisory

access.redhat.com / errata/RHBA-2019:0764

Third Party Advisory

access.redhat.com / errata/RHBA-2019:0959

Third Party Advisory

access.redhat.com / errata/RHSA-2019:0710

Third Party Advisory

access.redhat.com / errata/RHSA-2019:0765

Third Party Advisory

access.redhat.com / errata/RHSA-2019:0806

Third Party Advisory

access.redhat.com / errata/RHSA-2019:0902

Third Party Advisory

access.redhat.com / errata/RHSA-2019:0981

Third Party Advisory

access.redhat.com / errata/RHSA-2019:0997

Third Party Advisory

access.redhat.com / errata/RHSA-2019:1467

Third Party Advisory

access.redhat.com / errata/RHSA-2019:2980

Third Party Advisory

access.redhat.com / errata/RHSA-2019:3170

Third Party Advisory

bugs.python.org / issue36216

Issue TrackingPatchVendor Advisory

github.com / python/cpython/pull/12201

PatchThird Party Advisory

lists.debian.org / debian-lts-announce/2019/06/msg00022.html

Mailing ListThird Party Advisory

lists.debian.org / debian-lts-announce/2019/06/msg00023.html

Mailing ListThird Party Advisory

lists.debian.org / debian-lts-announce/2020/07/msg00011.html

Mailing ListThird Party Advisory

lists.debian.org / debian-lts-announce/2020/08/msg00034.html

Mailing ListThird Party Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3

python-security.readthedocs.io / vuln/urlsplit-nfkc-normalization.html

PatchThird Party Advisory

security.gentoo.org / glsa/202003-26

Third Party Advisory

security.netapp.com / advisory/ntap-20190517-0001

Third Party Advisory

usn.ubuntu.com / 4127-1

Third Party Advisory

usn.ubuntu.com / 4127-2

Third Party Advisory

oracle.com / security-alerts/cpujan2020.html

Third Party Advisory

oracle.com / security-alerts/cpujul2022.html

securityfocus.com / bid/107400

Third Party AdvisoryVDB Entry