CVE-2026-1502

HTTP client proxy tunnel headers not validated for CR/LF

State: Published
Severity: 5.7 Medium
Published: Apr 10, 2026
Updated: Aug 13, 2026
Reserved: Jan 27, 2026

Description

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

Scores

CVSS	Score	Vector	Source
4.0	5.7 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	PSF

Weaknesses

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

Affected Products

Product	Versions
CPythonPython Software Foundation	before 3.10.21Affected 3.11.0 to before 3.11.16Affected 3.12.0 to before 3.12.14Affected 3.13.0 to before 3.13.14Affected 3.14.0a1 to before 3.14.5rc1Affected 3.15.0a1 to before 3.15.0b1Affected

References

https://github.com/python/cpython/pull/146212patch
https://github.com/python/cpython/issues/146211issue-tracking
https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/vendor-advisory
https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69patch
https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2edpatch
https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8ddpatch
https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ecpatch
https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53patch
https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3epatch
http://www.openwall.com/lists/oss-security/2026/04/11/4

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.