CVE-2025-15282

Header injection via newlines in data URL mediatype

State: Published
Severity: 6.0 Medium
Published: Jan 20, 2026
Updated: Mar 3, 2026
Reserved: Dec 29, 2025

Description

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

Scores

CVSS	Score	Vector	Source
4.0	6.0 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N	PSF

Weaknesses

CWE-93

Affected Products

Product	Versions
CPythonPython Software Foundation	before 3.10.20Affected 3.11.0 to before 3.11.15Affected 3.12.0 to before 3.12.13Affected 3.13.0 to before 3.13.12Affected 3.14.0 to before 3.14.3Affected 3.15.0a1 to before 3.15.0a6Affected

References

https://github.com/python/cpython/pull/143926patch
https://github.com/python/cpython/issues/143925issue-tracking
https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/vendor-advisory
https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9fpatch
https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0patch
https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38patch
https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80patch
https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47patch
https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017apatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.