AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
← CVE index
Δ / VULNERABILITY RECORD

CVE-2019-9636.

Source-reported disclosure and enrichment record.

SEVERITY / CVSSCRITICAL / 9.8CVSS 3.1 · nvd@nist.gov
EXPLOITATION STATUSNot listed in the cached KEV catalogThis does not establish absence of exploitation.
RECORD STATUSModifiedModified Oct 07, 2026

Disclosure summary

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Source-reported weakness categories

NVD-CWE-noinfo, CWE-173

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

NIST National Vulnerability Database · NVD-CVE-2019-9636

Open original source · Updated Oct 07, 2026

Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.

VendorProduct / associationVersion / bounds
pythonpython* {"versionStartIncluding":"3.7.0","versionEndExcluding":"3.7.3"}
fedoraprojectfedora28
fedoraprojectfedora29
fedoraprojectfedora30
fedoraprojectfedora31
opensuseleap15.0
opensuseleap15.1
opensuseleap42.3
debiandebian_linux8.0
debiandebian_linux9.0
canonicalubuntu_linux12.04
canonicalubuntu_linux14.04
canonicalubuntu_linux16.04
canonicalubuntu_linux18.04
canonicalubuntu_linux19.04
redhatopenshift_container_platform3.11
redhatenterprise_linux7.5
redhatenterprise_linux8.0
redhatenterprise_linux_desktop6.0
redhatenterprise_linux_eus7.5
redhatenterprise_linux_eus8.1
redhatenterprise_linux_eus8.2
redhatenterprise_linux_eus8.4
redhatenterprise_linux_eus8.6
redhatenterprise_linux_server6.0
redhatenterprise_linux_server_aus7.4
redhatenterprise_linux_server_aus8.2
redhatenterprise_linux_server_aus8.4
redhatenterprise_linux_server_eus5.6
redhatenterprise_linux_server_tus7.4
redhatenterprise_linux_server_tus8.2
redhatenterprise_linux_server_tus8.4
redhatenterprise_linux_server_tus8.6
redhatenterprise_linux_workstation6.0
redhatvirtualization4.0
oraclesun_zfs_storage_appliance_kit8.8.6

Original records & references

PUBLISHED 2019-03-08T16:29:00-05:00
MODIFIED 2026-10-07T15:17:14-04:00
INGESTED 2026-10-08T12:30:34-04:00