Skip to content

HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF #146211

Closed
Closed
HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF#146211
Labels
3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Description

@sethmlarson
sethmlarson
opened on Mar 20, 2026

Bug report

Bug description:

HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF. Should sanitize the input of .set_tunnel() to avoid header splitting.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Other, Linux

Linked PRs

Activity

  1. sethmlarson
    added 2 commits that reference this issue on Apr 10, 2026

    [3.10] pythongh-146211: Reject CR/LF in HTTP tunnel request headers (p…

    fb7005a

    [3.11] pythongh-146211: Reject CR/LF in HTTP tunnel request headers (p…

    0431983
  2. mandree
    added 2 commits that reference this issue on Apr 11, 2026

    security/vuxml: add two more python vulns

    ef39fbd

    security/vuxml: add two more python vulns

    16aa19e
  3. hugovk
    added a commit that references this issue on Apr 21, 2026

    [3.14] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212

    b1cf901
  4. ljfp
    added a commit that references this issue on Apr 25, 2026

    pythongh-146211: Reject CR/LF in HTTP tunnel request headers (python#…

    2e5fe78
  5. bmwiedemann
    added 4 commits that reference this issue on Apr 28, 2026

    Update python315 to version 3.15.0~a8 / rev 12 via SR 1349644

    62afcad

    Update python310 to version 3.10.20 / rev 77 via SR 1349663

    279e0dd

    Update python315 to version 3.15.0~a8 / rev 13 via SR 1349863

    e0f2724

    Update python313 to version 3.13.13 / rev 41 via SR 1349656

    efb1aca
  6. StanFromIreland
    marked 3.10: CVE-2026-1502 fix for CR/LF in HTTP tunnel request headers appears unbackported #149197 as a duplicate of this issue on Apr 30, 2026
  7. Yhg1s
    added 2 commits that reference this issue on May 18, 2026

    [3.13] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212

    9e071c9

    [3.12] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212

    c00c386
  8. bmwiedemann
    added a commit that references this issue on Jun 22, 2026

    Update python312 to version 3.12.13 / rev 49 via SR 1360565

    0e1eb21
  9. illia-v
    added a commit that references this issue on Jun 24, 2026

    Port "Reject CR/LF in HTTP tunnel request headers"

    006263c
  10. pablogsal
    added 2 commits that reference this issue on Jun 27, 2026

    [3.11] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146… (

    56b7100

    [3.10] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146… (

    58703ec
  11. serhiy-storchaka
    closed this as completedon Jul 3, 2026
  12. illia-v
    added a commit that references this issue on Jul 5, 2026

    Port "Reject CR/LF in HTTP tunnel request headers" (#5091)

    e18a0d1
  13. arnout
    added a commit that references this issue on Aug 14, 2026

    package/python3: security bump to v3.12.14

    80251a0
  14. mcepl
    added 3 commits that reference this issue on Sep 18, 2026

    [CVE-2026-1502] Reject CR/LF in HTTP tunnel request headers

    7134503

    [CVE-2026-1502] Reject CR/LF in HTTP tunnel request headers

    dc97717

    [CVE-2026-1502] Reject CR/LF in HTTP tunnel request headers

    864be9d
  15. mcepl
    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-1502] Reject CR/LF in HTTP tunnel request headers

    b52335b

    [CVE-2026-1502] Reject CR/LF in HTTP tunnel request headers

    2ef408f

    [CVE-2026-1502] Reject CR/LF in HTTP tunnel request headers

    4d1cf9f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions