Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 WebOb, Open Redirect, #CVE-2024-42353 / #CVE-2026-44889 (Medium) -DC-Aug2026-1988 https://dailycve.com/webob-open-redirect-cve-2024-42353-cve-2026-44889-medium-dc-aug2026-1988/
Post summary
The post announces two CVEs affecting WebOb, indicating an open‑redirect flaw of medium severity, but offers no evidence of exploitation, PoC, or patches.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pylonsproject | webob | - | - | - |