# Vulnerability in F5 Products (CVE-2020-26116) - Python http.client CRLF Injection in BIG-IP Next SPK, BIG-IQ, F5OS-A, F5OS-C

> HKCERT/GovCERT.HK alert A26-11-01 (2026-11-02) reports that F5 BIG-IP Next SPK, BIG-IQ Centralized Management, F5OS-A and F5OS-C are affected by CVE-2020-26116, a CRLF/HTTP header injection flaw in the Python http.client module. The alert states successful exploitation could lead to security restriction bypass and tampering on an affected system; no in-the-wild exploitation is reported.

- **Published:** 2026-11-06T22:46:48Z
- **Last reviewed:** 2026-11-06T22:46:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5453
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5453.png
- **ID:** TL-2026-5453
- **Severity:** HIGH (CVSS 7.2)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 12
- **CVEs:** CVE-2020-26116

## Description

CVE-2020-26116 is a CRLF injection vulnerability in the http.client module of Python 3.x before 3.5.10, 3.6.12, 3.7.9 and 3.8.5. When an attacker controls the HTTP request method (the first argument of HTTPConnection.request), http.client does not reject carriage-return and line-feed characters, so an attacker can insert CR and LF control characters and inject additional HTTP headers or request content. The issue was tracked upstream as bpo-39603, first reported on 2020-02-10, and fixed in Python 3.8.5, 3.6.12, 3.7.9, 3.5.10 and 3.9.0. NVD published the CVE on 2020-09-27 and scores it CVSS 3.1 7.2 (HIGH), vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, CWE-74. The Python security tracker lists a score of 6.4, which differs from NVD; the NVD value is used here.

F5 advisory K000133759, referenced by GovCERT.HK alert A26-11-01 and the CVE record, ties the flaw to F5 products that ship an affected Python runtime. GovCERT.HK lists these affected versions: BIG-IP Next SPK 1.5.0-1.7.1; BIG-IQ Centralized Management 8.0.0-8.4.2; F5OS-A 1.3.0-1.3.2, 1.4.0, 1.5.1-1.5.4, 1.8.0-1.8.3; F5OS-C 1.3.0-1.3.2, 1.5.0-1.5.1, 1.6.0-1.6.4, 1.8.0-1.8.2. The alert describes the impact as security restriction bypass and tampering on an affected system and tells administrators to apply vendor patches and mitigations and to contact F5 for remediation guidance.

Exploitation requires an application code path that passes attacker-influenced data into the HTTP method argument of http.client; this is a library-level flaw, not a directly network-reachable defect in a F5 service. No exploitation in the wild, CISA KEV listing, public weaponized PoC, malware, threat actor or network IOC is documented in the sources reviewed. NVD's CISA SSVC data records exploitation as none. The F5 advisory page could not be loaded during research, so F5 fixed-version numbers are not stated here; consult K000133759. The vendor-specific exposure of each F5 product should be confirmed against that advisory.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1659 Content Injection
- T1211 Exploitation for Stealth
- T1565 Data Manipulation
- T1565.002 Transmitted Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2020-26116 CRLF Injection in HTTP Request Method Against F5 Appliances** (`TL-2026-5453-SPL-001`)

Detects HTTP requests logged by F5 ASM/WAF whose method token contains carriage-return/line-feed control characters, their percent-encoded forms (%0d/%0a), or any value that is not a plain alphabetic method token. This is the exploitation primitive of CVE-2020-26116 (Python http.client HTTPConnection.request method CRLF injection, bpo-39603, CWE-74) affecting BIG-IP Next SPK, BIG-IQ, F5OS-A and F5OS-C (F5 K000133759, GovCERT.HK A26-11-01). The flaw is reachable only through application code that forwards attacker-influenced data into the method argument of an unpatched Python http.client, so a hit on a management-plane or iControl REST virtual server is anomalous and worth triage. No in-the-wild exploitation is documented.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1659, T1210
- **Data sources:** f5:bigip:asm:syslog, F5 BIG-IP ASM / Advanced WAF, CommonSecurityLog (F5 CEF), webserver logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=f5 sourcetype="f5:bigip:asm:syslog" earliest=-24h
| eval http_method=coalesce(method, http_method), client=coalesce(ip_client, src_ip, src), request_uri=coalesce(uri, request)
| where isnotnull(http_method) AND (match(http_method, "[[:cntrl:]]|%0[dDaA]") OR NOT match(http_method, "^[A-Za-z]{3,16}$"))
| stats count min(_time) as first_seen max(_time) as last_seen values(request_uri) as request_uris by client, dest, http_method
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ "F5"
| where isnotempty(RequestMethod)
| where RequestMethod matches regex @'(?i)%0[da]|[\x00-\x1f]' or not(RequestMethod matches regex @'^[A-Za-z]{3,16}$')
| project TimeGenerated, DeviceProduct, DeviceAddress, SourceIP, DestinationIP, RequestMethod, RequestURL, Activity
```

### Sigma

```yaml
title: CVE-2020-26116 CRLF Injection in HTTP Request Method
id: 5c1d7a42-8e3b-4f6a-9b21-3a7d0c5e1f01
status: experimental
description: Detects HTTP request methods containing CR/LF control characters or their percent-encoded forms, the exploitation primitive of CVE-2020-26116 (Python http.client header injection via the method argument).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2020-26116
  - https://my.f5.com/manage/s/article/K000133759
  - https://bugs.python.org/issue39603
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1659
  - attack.lateral_movement
  - attack.t1210
  - cve.2020-26116
logsource:
  category: webserver
detection:
  selection_ctrl:
    cs-method|re: '[\x00-\x1f]'
  selection_encoded:
    cs-method|contains:
      - '%0d'
      - '%0a'
  condition: 1 of selection_*
falsepositives:
  - Fuzzing or authorized vulnerability scanning against F5 management interfaces
  - Malformed requests from broken HTTP client libraries
level: high
```

**Known false positives:**

- Authorized vulnerability scanners or fuzzers sending malformed methods to F5 management or virtual-server endpoints
- Broken or custom HTTP clients that emit non-standard method tokens

**Tuning notes:** Adjust the field names (method/http_method, ip_client/src_ip) to your F5 ASM log profile and extend the allowed-method regex if WebDAV or custom verbs are legitimate. Exclude scanner source IPs via a lookup. Scope to management-plane and iControl REST virtual servers first to reduce noise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2020-26116 Sentinel: Malformed-Method Probing Burst Against F5 Management Plane (locked: unlock with TL Creds)
- CVE-2020-26116 Sentinel: F5 Management Configuration Change Following Malformed Method (locked: unlock with TL Creds)
- CVE-2020-26116 Sentinel: Injected Auth or Routing Header After CRLF in F5 Requests (locked: unlock with TL Creds)
- CVE-2020-26116 Sigma: CRLF in HTTP Method on Web Logs (locked: unlock with TL Creds)
- CVE-2020-26116 Sigma: [indicator] Validation Errors in Appliance Syslog (locked: unlock with TL Creds)
- CVE-2020-26116 Sigma: Injected Authentication Header After CRLF in Proxy Logs (locked: unlock with TL Creds)
- CVE-2020-26116 [indicator] Control-Character Rejection on F5 Appliance (locked: unlock with TL Creds)
- CVE-2020-26116 Injected Authentication or Routing Headers via CRLF in F5 Requests (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [GovCERT.HK Security Alert A26-11-01: F5 Products Vulnerability](https://www.govcert.gov.hk/en/alerts_detail.php?id=2156)
- [F5 Security Advisory K000133759](https://my.f5.com/manage/s/article/K000133759)
- [NVD - CVE-2020-26116](https://nvd.nist.gov/vuln/detail/CVE-2020-26116)
- [MITRE CVE Record CVE-2020-26116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26116)
- [Python Security: http.client HTTP Header Injection in the HTTP method](https://python-security.readthedocs.io/vuln/http-header-injection-method.html)
- [Python bug tracker bpo-39603](https://bugs.python.org/issue39603)
- [Ubuntu Security Notice USN-4581-1](https://usn.ubuntu.com/4581-1/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5453