Skip to content

Reject control characters in wsgiref.headers.Headers #143916

Closed
Closed
Reject control characters in wsgiref.headers.Headers#143916
Labels
stdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Description

@sethmlarson
sethmlarson
opened on Jan 16, 2026

Linked PRs

Activity

  1. sethmlarson
    closed this as completedon Jan 20, 2026

  2. vytas7 commented on Jan 21, 2026

    @vytas7
    vytas7
    on Jan 21, 2026

    Hey @sethmlarson, not to take away from this great security initiative, but could you elaborate on disallowing HTAB (0x09) in header values?

    My interpretation of RFC 9110, 5.5. Field values is that HTAB should be allowed.

  3. sethmlarson commented on Jan 21, 2026

    @sethmlarson
    sethmlarson
    on Jan 21, 2026
    ContributorAuthor

    @vytas7 Ah dang, you are right. I'll submit a follow-up pull request to this PR.

  4. frenzymadness
    added a commit that references this issue on Jan 30, 2026

    00473: CVE-2026-0865

    c8f6d57
  5. picnixz
    marked [security] Disallow usage of control characters in status, headers and values for security in Lib/wsgiref/handlers.py #144370 as a duplicate of this issue on Jan 31, 2026
  6. picnixz
    unmarked [security] Disallow usage of control characters in status, headers and values for security in Lib/wsgiref/handlers.py #144370 as a duplicate of this issue on Feb 1, 2026
  7. frenzymadness
    added a commit that references this issue on Feb 2, 2026

    00473: CVE-2026-0865

    881d22e
  8. hroncok
    added a commit that references this issue on Feb 3, 2026

    00473: CVE-2026-0865

    b6b7f6f
  9. hrnciar
    added 6 commits that reference this issue on Feb 5, 2026

    00473: Downstream only: Reject control characters in wsgiref.headers.…

    b4d4766

    00473: CVE-2026-0865

    37c1f47

    00473: CVE-2026-0865

    37a1fbe

    00473: CVE-2026-0865

    da23884

    00473: CVE-2026-0865

    88fb47f

    00473: CVE-2026-0865

    bbf25b0
  10. sethmlarson
    added a commit that references this issue on Feb 12, 2026

    gh-143916: Allow HTAB in wsgiref header values

    66da7bf
  11. miss-islington
    added 4 commits that reference this issue on Feb 12, 2026

    pythongh-143916: Allow HTAB in wsgiref header values

    7d84940

    pythongh-143916: Allow HTAB in wsgiref header values

    31fdf95

    pythongh-143916: Allow HTAB in wsgiref header values

    db492ed

    pythongh-143916: Allow HTAB in wsgiref header values

    4a4a07e
  12. bmwiedemann
    added a commit that references this issue on Feb 13, 2026

    Update python310 to version 3.10.19 / rev 71 via SR 1332783

    5585b8b
  13. thunder-coding
    added 2 commits that reference this issue on Feb 15, 2026

    pythongh-143916: Reject control characters in wsgiref.headers.Headers (

    d5091ae

    pythongh-143916: Allow HTAB in wsgiref header values

    11aab12
  14. bmwiedemann
    added 2 commits that reference this issue on Feb 18, 2026

    Update python312 to version 3.12.12 / rev 43 via SR 1332782

    82a6b4d

    Update python311 to version 3.11.14 / rev 63 via SR 1332828

    586ca21
  15. picnixz
    reopened this on Feb 21, 2026

  16. picnixz commented on Feb 21, 2026

    @picnixz
    picnixz
    on Feb 21, 2026
    Member

    Backports are still hanging and I believe the fix should be backported to security branches as well as otherwise we are removing a possible correct behavior in security-only branches.

    @sethmlarson

  17. picnixz
    added
    release-blocker
    on Feb 21, 2026
  18. github-project-automation
    added this to Release and Deferred blockers 🚫on Feb 21, 2026
  19. github-project-automation
    moved this to Todo in Release and Deferred blockers 🚫on Feb 21, 2026
  20. hugovk
    added
    3.13only security fixes
    3.14bugs and security fixes
    on Feb 21, 2026
  21. hugovk
    added a commit that references this issue on Feb 21, 2026

    [3.14] gh-143916: Allow HTAB in wsgiref header values (#144761)

    bfba660
  22. hugovk
    removed
    3.14bugs and security fixes
    on Feb 21, 2026

  23. hugovk commented on Feb 21, 2026

    @hugovk
    hugovk
    on Feb 21, 2026
    Member

    Merged into 3.14.

  24. picnixz
    added
    3.11only security fixes
    3.10 (EOL)end of life
    3.12only security fixes
    on Feb 21, 2026
  25. encukou
    added a commit that references this issue on Feb 23, 2026

    [3.13] gh-143916: Allow HTAB in wsgiref header values (GH-144762)

    83ecd18
  26. miss-islington
    added 3 commits that reference this issue on Feb 23, 2026

    pythongh-143916: Allow HTAB in wsgiref header values

    9a712fb

    pythongh-143916: Allow HTAB in wsgiref header values

    97239ca

    pythongh-143916: Allow HTAB in wsgiref header values

    1e85703
  27. Yhg1s
    added a commit that references this issue on Feb 23, 2026

    [3.12] gh-143916: Allow HTAB in wsgiref header values (#145141)

    8bb044d
  28. picnixz
    removed
    3.12only security fixes
    3.13only security fixes
    on Feb 23, 2026
  29. brijkapadia
    added a commit that references this issue on Feb 28, 2026

    pythongh-143916: Allow HTAB in wsgiref header values

    05c706a
  30. pablogsal
    added 2 commits that reference this issue on Mar 2, 2026

    [3.11] gh-143916: Allow HTAB in wsgiref header values (#145139)

    286e3ac

    [3.10] gh-143916: Allow HTAB in wsgiref header values (#145140)

    c592227
  31. pablogsal
    closed this as completedon Mar 2, 2026
  32. github-project-automation
    moved this from Todo to Done in Release and Deferred blockers 🚫on Mar 2, 2026
  33. picnixz
    removed
    release-blocker
    3.11only security fixes
    3.10 (EOL)end of life
    on Mar 2, 2026
  34. hroncok
    added a commit that references this issue on Mar 26, 2026

    00473: CVE-2026-0865

    c4e439f
  35. ljfp
    added a commit that references this issue on Apr 25, 2026

    pythongh-143916: Allow HTAB in wsgiref header values

    2343eeb
  36. mcepl
    added 2 commits that reference this issue on Sep 18, 2026

    [CVE-2026-0865] Reject control characters in wsgiref.headers.Headers

    711c380

    [CVE-2026-0865] Reject control characters in wsgiref.headers.Headers

    1354609
  37. mcepl
    added 2 commits that reference this issue on Oct 1, 2026

    [CVE-2026-0865] Reject control characters in wsgiref.headers.Headers

    cbc2efa

    [CVE-2026-0865] Reject control characters in wsgiref.headers.Headers

    1fe2a6b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions