CVE-2026-1502: Python CPython CRLF injection in HTTP client proxy tunnel headers

CVE-2026-1502 · Severity: info · CVSS 5.7 · Published 2026-04-10

A vulnerability in the Python standard library's HTTP client could allow an attacker to manipulate web traffic when using a proxy. By injecting special characters into connection requests, an attacker could potentially split a single request into multiple ones, leading to unauthorized actions or data manipulation. This affects applications that use Python's built-in tools to connect to the internet through a proxy server.

Technologies: Python Software Foundation CPython. Vendors: Python Software Foundation.

Quick answers

Is CVE-2026-1502 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-1502 being exploited in the wild.
How severe is CVE-2026-1502?
Informational severity, with a CVSS score of 5.7, published 10 April 2026.
Which products and versions are affected?
Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
Is there a fix for CVE-2026-1502?
A patch was published on 2026-04-10: Fixes merged into CPython main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1502 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-1502?
Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A CRLF injection vulnerability (CWE-93) exists in CPython's 'http.client' module. The 'set_tunnel()' method failed to sanitize carriage return (CR) and line feed (LF) characters in the host and header parameters used during HTTP CONNECT tunneling. An attacker who can control these inputs can perform HTTP request splitting or header injection against the proxy server. This could be used to bypass security controls or poison web caches. The issue has been addressed in multiple CPython branches (3.10 through 3.15) by rejecting headers containing CR or LF bytes.

Affected products

  • Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14, 3.15

Timeline

  • 2026-03-20: disclosed: Issue reported on GitHub by sethmlarson
  • 2026-04-10: patched: Fixes merged into CPython main branch
  • 2026-04-10: advisory: Security announcement published by Python Software Foundation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.