Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/bottle@0.12.19
purl pkg:pypi/bottle@0.12.19
Next non-vulnerable version 0.12.20
Latest non-vulnerable version 0.12.20
Risk
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-6f4p-1f4y-ryag
Aliases:
CVE-2022-31799
GHSA-xhp9-4947-rq78
PYSEC-2022-227
Bottle before 0.12.20 mishandles errors during early request binding.
0.12.20
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-yhx1-tap2-h7bb The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. CVE-2020-28473
GHSA-qhx9-7hx7-cp4r
PYSEC-2021-129
SNYK-PYTHON-BOTTLE-1017108

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:17:21.579596+00:00 Pypa Importer Affected by VCID-6f4p-1f4y-ryag https://github.com/pypa/advisory-database/blob/main/vulns/bottle/PYSEC-2022-227.yaml 38.6.0
2026-06-02T04:08:19.389533+00:00 Pypa Importer Fixing VCID-yhx1-tap2-h7bb https://github.com/pypa/advisory-database/blob/main/vulns/bottle/PYSEC-2021-129.yaml 38.6.0