fr Sign in

5.7 Medium

CVE-2026-1502 CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host

Description

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

Affected products and versions

Product	Affected versions	Fixed in
CPython 3.15	3.15.0a1 → < 3.15.0b1	3.15.0b1
CPython 3.14	3.14.0a1 → < 3.14.5rc1	3.14.5rc1
CPython 3.13	3.13.0 → < 3.13.14	3.13.14
CPython 3.12	3.12.0 → < 3.12.14	3.12.14
CPython 3.11	3.11.0 → < 3.11.16	3.11.16
CPython 3.10	earliest → < 3.10.21	3.10.21

References

github.com github.com
github.com github.com
mail.python.org mail.python.org
github.com github.com
github.com github.com
github.com github.com
github.com github.com
github.com github.com
github.com github.com

Timeline

Published April 10, 2026
Last modified August 13, 2026

The 79 CVEs of CPython →

CVE-2026-116566 socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be… 5.3 Medium CVE-2026-103995 Lenient parsing of integers for response body and chunk framing 2.0 Low CVE-2026-115557 Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without… 9.4 Critical CVE-2026-114583 tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like… 6.9 Medium

Track this CVE