Threat reportVulnerabilityTL-2026-5453
Vulnerability in F5 Products (CVE-2020-26116) - Python http.client CRLF Injection in BIG-IP Next SPK, BIG-IQ, F5OS-A, F5OS-C
HKCERT/GovCERT.HK alert A26-11-01 (2026-11-02) reports that F5 BIG-IP Next SPK, BIG-IQ Centralized Management, F5OS-A and F5OS-C are affected by CVE-2020-26116, a CRLF/HTTP header injection flaw in the Python http.client module. The alert states successful exploitation could lead to security restriction bypass and tampering on an affected system; no in-the-wild exploitation is reported. First disclosed .
Key facts for F5 Python CRLF flaw
| Identifiers | TL-2026-5453, CVE-2020-26116 |
|---|---|
| Also known as | GovCERT.HK A26-11-01, F5 K000133759, bpo-39603 |
| Severity | HIGH |
| CVSS | 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) |
| First disclosed | |
| Exploitation status | No exploitation observed (theoretical) |
| EPSS | CVE-2020-26116: 6.3% (93.6th percentile) |
| Affected products | F5 BIG-IP Next SPK; F5 BIG-IQ Centralized Management; F5 F5OS-A; F5 F5OS-C; Python Software Foundation Python (http.client) |
| Weaknesses (CWE) | CWE-74 |
| Malware | Python, httpclient - S0068 |
| MITRE ATT&CK techniques | T1190 Exploit Public-Facing Application, T1211 Exploitation for Stealth, T1565 Data Manipulation, T1565.002 Transmitted Data Manipulation, T1659 Content Injection |
| Motivation | UNKNOWN |
| Target sectors | government administration, telecoms, finance, technology |
| Target regions | Global |
| Detection rules | 9 (1 shown free) |
| Sources | 7 cited sources |
Detection coverage for F5 Python CRLF flaw
As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5453 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: CVE-2020-26116 CRLF Injection in HTTP Request Method Against F5 Appliances
Detects HTTP requests logged by F5 ASM/WAF whose method token contains carriage-return/line-feed control characters, their percent-encoded forms (%0d/%0a), or any value that is not a plain alphabetic method token. This is the exploitation primitive of CVE-2020-26116 (Python http.client HTTPConnection.request method CRLF injection, bpo-39603, CWE-74) affecting BIG-IP Next SPK, BIG-IQ, F5OS-A and F5OS-C (F5 K000133759, GovCERT.HK A26-11-01). The flaw is reachable only through application code that forwards attacker-influenced data into the method argument of an unpatched Python http.client, so a hit on a management-plane or iControl REST virtual server is anomalous and worth triage. No in-the-wild exploitation is documented.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1190, T1659, T1210
- Data sources: f5:bigip:asm:syslog, F5 BIG-IP ASM / Advanced WAF, CommonSecurityLog (F5 CEF), webserver logs
- Severity: high
- Confidence: high
Splunk SPL
index=f5 sourcetype="f5:bigip:asm:syslog" earliest=-24h
| eval http_method=coalesce(method, http_method), client=coalesce(ip_client, src_ip, src), request_uri=coalesce(uri, request)
| where isnotnull(http_method) AND (match(http_method, "[[:cntrl:]]|%0[dDaA]") OR NOT match(http_method, "^[A-Za-z]{3,16}$"))
| stats count min(_time) as first_seen max(_time) as last_seen values(request_uri) as request_uris by client, dest, http_method
| convert ctime(first_seen) ctime(last_seen)Microsoft KQL
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ "F5"
| where isnotempty(RequestMethod)
| where RequestMethod matches regex @'(?i)%0[da]|[\x00-\x1f]' or not(RequestMethod matches regex @'^[A-Za-z]{3,16}$')
| project TimeGenerated, DeviceProduct, DeviceAddress, SourceIP, DestinationIP, RequestMethod, RequestURL, ActivitySigma
title: CVE-2020-26116 CRLF Injection in HTTP Request Method
id: 5c1d7a42-8e3b-4f6a-9b21-3a7d0c5e1f01
status: experimental
description: Detects HTTP request methods containing CR/LF control characters or their percent-encoded forms, the exploitation primitive of CVE-2020-26116 (Python http.client header injection via the method argument).
references:
- https://nvd.nist.gov/vuln/detail/CVE-2020-26116
- https://my.f5.com/manage/s/article/K000133759
- https://bugs.python.org/issue39603
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
- attack.initial_access
- attack.t1190
- attack.t1659
- attack.lateral_movement
- attack.t1210
- cve.2020-26116
logsource:
category: webserver
detection:
selection_ctrl:
cs-method|re: '[\x00-\x1f]'
selection_encoded:
cs-method|contains:
- '%0d'
- '%0a'
condition: 1 of selection_*
falsepositives:
- Fuzzing or authorized vulnerability scanning against F5 management interfaces
- Malformed requests from broken HTTP client libraries
level: highKnown false positives:
- Authorized vulnerability scanners or fuzzers sending malformed methods to F5 management or virtual-server endpoints
- Broken or custom HTTP clients that emit non-standard method tokens
Tuning notes: Adjust the field names (method/http_method, ip_client/src_ip) to your F5 ASM log profile and extend the allowed-method regex if WebDAV or custom verbs are legitimate. Exclude scanner source IPs via a lookup. Scope to management-plane and iControl REST virtual servers first to reduce noise.
- CVE-2020-26116 Sentinel: Malformed-Method Probing Burst Against F5 Management Plane · unlock with TL Creds
- CVE-2020-26116 Sentinel: F5 Management Configuration Change Following Malformed Method · unlock with TL Creds
- CVE-2020-26116 Sentinel: Injected Auth or Routing Header After CRLF in F5 Requests · unlock with TL Creds
- CVE-2020-26116 Sigma: CRLF in HTTP Method on Web Logs · unlock with TL Creds
- CVE-2020-26116 Sigma: [indicator] Validation Errors in Appliance Syslog · unlock with TL Creds
- CVE-2020-26116 Sigma: Injected Authentication Header After CRLF in Proxy Logs · unlock with TL Creds
- CVE-2020-26116 [indicator] Control-Character Rejection on F5 Appliance · unlock with TL Creds
- CVE-2020-26116 Injected Authentication or Routing Headers via CRLF in F5 Requests · unlock with TL Creds
Indicators of compromise for F5 Python CRLF flaw
As of 2026-11-06, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5453.
How F5 Python CRLF flaw works
CVE-2020-26116 is a CRLF injection vulnerability in the http.client module of Python 3.x before 3.5.10, 3.6.12, 3.7.9 and 3.8.5. When an attacker controls the HTTP request method (the first argument of HTTPConnection.request), http.client does not reject carriage-return and line-feed characters, so an attacker can insert CR and LF control characters and inject additional HTTP headers or request content. The issue was tracked upstream as bpo-39603, first reported on 2020-02-10, and fixed in Python 3.8.5, 3.6.12, 3.7.9, 3.5.10 and 3.9.0. NVD published the CVE on 2020-09-27 and scores it CVSS 3.1 7.2 (HIGH), vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, CWE-74. The Python security tracker lists a score of 6.4, which differs from NVD; the NVD value is used here.
F5 advisory K000133759, referenced by GovCERT.HK alert A26-11-01 and the CVE record, ties the flaw to F5 products that ship an affected Python runtime. GovCERT.HK lists these affected versions: BIG-IP Next SPK 1.5.0-1.7.1; BIG-IQ Centralized Management 8.0.0-8.4.2; F5OS-A 1.3.0-1.3.2, 1.4.0, 1.5.1-1.5.4, 1.8.0-1.8.3; F5OS-C 1.3.0-1.3.2, 1.5.0-1.5.1, 1.6.0-1.6.4, 1.8.0-1.8.2. The alert describes the impact as security restriction bypass and tampering on an affected system and tells administrators to apply vendor patches and mitigations and to contact F5 for remediation guidance.
Exploitation requires an application code path that passes attacker-influenced data into the HTTP method argument of http.client; this is a library-level flaw, not a directly network-reachable defect in a F5 service. No exploitation in the wild, CISA KEV listing, public weaponized PoC, malware, threat actor or network IOC is documented in the sources reviewed. NVD's CISA SSVC data records exploitation as none. The F5 advisory page could not be loaded during research, so F5 fixed-version numbers are not stated here; consult K000133759. The vendor-specific exposure of each F5 product should be confirmed against that advisory.
MITRE ATT&CK techniques by tactic:
Initial Access
T1190 Exploit Public-Facing Application; T1659 Content Injection
Stealth
T1211 Exploitation for Stealth
Impact
T1565 Data Manipulation; T1565.002 Transmitted Data Manipulation
Remediation for F5 Python CRLF flaw
Patches
- Upgrade F5 products to the fixed releases listed in F5 advisory K000133759
- Upstream Python fixes: 3.8.5, 3.6.12, 3.7.9, 3.5.10, 3.9.0
Immediate actions
- Review F5 advisory K000133759 and identify BIG-IP Next SPK, BIG-IQ, F5OS-A and F5OS-C instances within the affected version ranges
- Apply F5-provided patches and mitigations as directed by K000133759
- Restrict management-plane access of affected F5 systems to trusted networks
Workarounds
- Contact F5 for deployment-specific mitigations as advised by GovCERT.HK alert A26-11-01
- Validate or reject CR and LF characters in any value used as the HTTP method before calling http.client in custom code
Longer-term hardening
- Track embedded third-party runtimes (Python) in appliance software as part of vulnerability management
- Monitor F5 appliance logs and outbound HTTP requests for CR/LF characters in request methods or headers
Affected and fixed versions
- F5 — BIG-IP Next SPK
Vulnerable versions: 1.5.0 - 1.7.1 - F5 — BIG-IQ Centralized Management
Vulnerable versions: 8.0.0 - 8.4.2 - F5 — F5OS-A
Vulnerable versions: 1.3.0 - 1.3.2; 1.4.0; 1.5.1 - 1.5.4; 1.8.0 - 1.8.3 - F5 — F5OS-C
Vulnerable versions: 1.3.0 - 1.3.2; 1.5.0 - 1.5.1; 1.6.0 - 1.6.4; 1.8.0 - 1.8.2 - Python Software Foundation — Python (http.client)
Vulnerable versions: 3.x before 3.5.10; 3.6.x before 3.6.12; 3.7.x before 3.7.9; 3.8.x before 3.8.5
Fixed in: 3.5.10; 3.6.12; 3.7.9; 3.8.5; 3.9.0
Timeline of F5 Python CRLF flaw
- HTTP method CRLF injection in locked-ioc-5 reported upstream and tracked as bpo-39603 (reporter: Max)
- Python 3.8.5 released with the fix (commit locked-ioc-7)
- Python 3.6.12 and 3.7.9 released with the fix (commits locked-ioc-8 and locked-ioc-9)
- Python 3.5.10 released with the fix (commit locked-ioc-10)
- CVE-2020-26116 published in NVD with CVSS 3.1 base score 7.2 (HIGH), CWE-74
- Python 3.9.0 released with the fix (commit locked-ioc-11)
- GovCERT.HK/HKCERT publishes alert A26-11-01 listing CVE-2020-26116 in BIG-IP Next SPK, BIG-IQ, F5OS-A and F5OS-C, referencing F5 advisory K000133759
Sources cited for F5 Python CRLF flaw
- GovCERT.HK Security Alert A26-11-01: F5 Products Vulnerability govcert.gov.hk · Advisory · 2026-11-02
- NVD - CVE-2020-26116 NVD (NIST) · Advisory · 2020-09-27
- MITRE CVE Record CVE-2020-26116 MITRE · Advisory · 2020-09-27
- Ubuntu Security Notice USN-4581-1 usn.ubuntu.com · Advisory · 2020-10-06
- F5 Security Advisory K000133759 my.f5.com · Vendor report
- Python Security: http.client HTTP Header Injection in the HTTP method python-security.readthedocs.io · Research · 2020-02-10
- Python bug tracker bpo-39603 bugs.python.org · Code repository · 2020-02-10
Previous and next in vulnerability
Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.
