Executive brief
A vulnerability in the Python standard library's HTTP client could allow an attacker to manipulate web traffic when using a proxy. By injecting special characters into connection requests, an attacker could potentially split a single request into multiple ones, leading to unauthorized actions or data manipulation. This affects applications that use Python's built-in tools to connect to the internet through a proxy server.
Technical details
A CRLF injection vulnerability (CWE-93) exists in CPython's 'http.client' module. The 'set_tunnel()' method failed to sanitize carriage return (CR) and line feed (LF) characters in the host and header parameters used during HTTP CONNECT tunneling. An attacker who can control these inputs can perform HTTP request splitting or header injection against the proxy server. This could be used to bypass security controls or poison web caches. The issue has been addressed in multiple CPython branches (3.10 through 3.15) by rejecting headers containing CR or LF bytes.
Affected products
- Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14, 3.15
Timeline
- 2026-03-20: disclosed: Issue reported on GitHub by sethmlarson
- 2026-04-10: patched: Fixes merged into CPython main branch
- 2026-04-10: advisory: Security announcement published by Python Software Foundation
References
- https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69
- https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8dd
- https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2ed
- https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ec
- https://github.com/python/cpython/issues/146211
- https://github.com/python/cpython/pull/146212
- https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/