Is CVE-2026-103995 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103995 being exploited in the wild.

How severe is CVE-2026-103995?

Informational severity, published 27 October 2026.

Which products and versions are affected?

Python CPython before fix (exact versions not specified in advisory).

Is there a fix for CVE-2026-103995?

A patch was published on 2026-10-08: PR #150752 merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103995 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103995?

Check whether you run Python CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103995: Python http.client HTTP response parsing bypass

CVE-2026-103995 · Severity: info · Published 2026-10-27

Python's http.client library incorrectly parses HTTP response headers that contain non-compliant Content-Length and chunk-size values, allowing responses to be misinterpreted. An attacker or misconfigured server could send specially crafted HTTP responses that a strict front-end gateway would reject, but Python would accept and process differently, potentially leading to response smuggling or cache poisoning attacks.

Technologies: Python CPython. Vendors: Python.

Quick answers

Is CVE-2026-103995 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103995 being exploited in the wild.
How severe is CVE-2026-103995?: Informational severity, published 27 October 2026.
Which products and versions are affected?: Python CPython before fix (exact versions not specified in advisory).
Is there a fix for CVE-2026-103995?: A patch was published on 2026-10-08: PR #150752 merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103995 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103995?: Check whether you run Python CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The http.client module uses Python's int() function to parse Content-Length headers and chunked transfer encoding chunk-size values, but int() is more permissive than RFC 9112, accepting leading signs (+/-), underscores, whitespace, and 0x prefixes. Values like "+5", "5_0", "-5", and "0x5" are accepted where RFC 9112 only allows 1*DIGIT and 1*HEXDIG respectively. This causes HTTP request smuggling (CWE-444) when a strict front-end gateway parses these headers differently than Python's http.client.

Affected products

Python CPython before fix (exact versions not specified in advisory)

Timeline

2026-06-02: disclosed
2026-10-27: advisory
2026-10-08: patched: PR #150752 merged

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.