Open redirect in py3-webob - CVE-2026-44889

Vulnerability identifier: #VU162710

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-44889

CWE-ID: CWE-601

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an unauthenticated remote attacker to redirect users from a trusted WebOb application to an attacker-controlled website.

The vulnerability exists due to WebOb's Location header normalization failing to account for Python URL parsing stripping ASCII tabs, carriage returns, and newlines between leading slashes in redirect targets. An unauthenticated remote attacker can supply a crafted redirect target that becomes an external hostname reference after parsing and lure a user into following the resulting redirect.

py3-webob
Ubuntu
openEuler
Anolis OS
python3-webob (Ubuntu package)
python-webob (Ubuntu package)
python-webob
python3-webob
python3-webob-doc

Install security update from vendor's website.

py3-webob - update to 1.8.10
python3-webob (Ubuntu package) - addressed in versions 1.5.1-1ubuntu0.1~esm2, 1:1.7.3-2ubuntu0.1~esm2, 1:1.8.5-2ubuntu0.1+esm1, 1:1.8.6-1.1ubuntu0.2, 1:1.8.7-1ubuntu0.1.24.04.2, 1:1.8.9-1ubuntu0.1
python-webob (Ubuntu package) - addressed in versions 1.5.1-1ubuntu0.1~esm2, 1:1.7.3-2ubuntu0.1~esm2
python-webob - update to 1.8.7-4
python3-webob - update to 1.8.7-4
python3-webob - update to 1.8.10-1
python3-webob-doc - update to 1.8.10-1

• https://github.com/Pylons/webob/security/advisories/GHSA-fh3h-vg37-cc95

• Open redirect in py3-webob
• openEuler update for python-webob
• Anolis OS update for python-webob
• Ubuntu update for python-webob