gh-142533: Document CRLF injection vulnerability in http.server and wsgiref modules by tadejmagajna · Pull Request #143395 · python/cpython

tadejmagajna · 2026-01-03T21:26:53Z

This change documents the CRLF injection vulnerability for http headers in http.server and wsgiref modules.

Initial report in #142533 focused on http.server only, though further discussion suggested also addressing a closely related vulnerability in wsgiref referenced in related issues #55880 and #72964.

After discussing #142605, we pivoted from a direct fix to a documentation update because a fix would disrupt users who rely on using the vulnerability for non-malicious purposes.

The change documents the low-level vulnerability (i.e. absence of checking for CRLF) in mehod-specific sections while describing the high level implications (i.e. assuming sanitized input) under the "Security considerations" section.

Issue: Document CRLF handling for http.server #142533

📚 Documentation preview 📚: https://cpython-previews--143395.org.readthedocs.build/

… and wsgiref modules

aisk · 2026-01-04T02:48:18Z

Hi, according to the Dev Guide, the document only changes don't need a news entry file.

picnixz · 2026-01-04T14:15:50Z

+ This method does not reject input containing CRLF sequences allowing the
+ possibility of CRLF injection, where a single method call can inject
+ multiple arbitrary headers.


Suggested change
This method does not reject input containing CRLF sequences allowing the
possibility of CRLF injection, where a single method call can inject
multiple arbitrary headers.
This method does not reject input containing CRLF sequences.
Only mention the possibility of CRLF injection in the security consideration section.

Thank you for the suggestion. Addressed for both modules

picnixz · 2026-01-04T14:16:17Z

+ This method does not reject input containing CRLF sequences allowing the
+ possibility of CRLF injection, where a single method call can inject
+ multiple arbitrary headers.


…on section only

picnixz · 2026-01-04T15:39:46Z

+Security considerations
+-----------------------


Please format this the same as we did for Http.server, that is: add a label and enough blank lines.

tadejmagajna · 2026-01-17T10:35:28Z

@picnixz thank you for the suggestions. I believe this is addressed now.

vstinner

LGTM

vstinner · 2026-01-19T14:21:11Z

cc @SethMichaelLarson @gpshead @serhiy-storchaka: Do you want to double check this change?

tadejmagajna · 2026-03-10T21:45:24Z

Thank you for review approval to both.

The first GitHub profile mentioned in the comment above says in their bio we likely meant @sethmlarson so tagging them here.

wsgiref was modified in the meanwhile to reject control characters including newline characters.

vstinner · 2026-03-11T11:45:03Z


 Content-Disposition: attachment; filename="bud.gif"

+ This method does not reject input containing CRLF sequences.


This is no longer true, please check the update wsgiref code.

Indeed, the vulnerability was addressed while this change was in review. Thank you.
I removed my wsgiref.rst changes, while leaving http.server.rst change in place as it remains relevant.

…rability

…cumentation since the issue was recently fixed

vstinner · 2026-04-01T23:42:25Z

 requests, this makes it possible for files outside of the specified directory
 to be served.

+The :meth:`BaseHTTPRequestHandler.send_header` method assumes sanitized input


and send_response_only()

Co-authored-by: Victor Stinner <vstinner@python.org>

vstinner

LGTM

miss-islington-app · 2026-04-02T21:26:26Z

Thanks @tadejmagajna for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

…er doc (pythonGH-143395) (cherry picked from commit 617f4cc) Co-authored-by: Tadej Magajna <tmagajna@gmail.com> Co-authored-by: Victor Stinner <vstinner@python.org>

bedevere-app · 2026-04-02T21:26:49Z

GH-148020 is a backport of this pull request to the 3.14 branch.

…er doc (pythonGH-143395) (cherry picked from commit 617f4cc) Co-authored-by: Tadej Magajna <tmagajna@gmail.com> Co-authored-by: Victor Stinner <vstinner@python.org>

bedevere-app · 2026-04-02T21:26:53Z

GH-148021 is a backport of this pull request to the 3.13 branch.

vstinner · 2026-04-02T21:31:00Z

Since wsgiref was modified recently to reject control characters, I hesitated to propose changing http.server to reject also control characters such as CRLF. But Serhiy is right, http.server users are responsible to pass data encoded for HTTP and so wrap long lines with CRLF: #142533 (comment). So it's better to document the vulnerability rather than fixing it.

http.server has now a long history, it's late to change how data is encoded without breaking existing code.

vstinner · 2026-04-02T21:31:26Z

PR merged, thanks for your contribution. I backported the doc change to 3.13 and 3.14 branches.

…ver doc (GH-143395) (#148020) gh-142533: Document CRLF injection vulnerabilities in http.server doc (GH-143395) (cherry picked from commit 617f4cc) Co-authored-by: Tadej Magajna <tmagajna@gmail.com> Co-authored-by: Victor Stinner <vstinner@python.org>

…ver doc (GH-143395) (#148021) gh-142533: Document CRLF injection vulnerabilities in http.server doc (GH-143395) (cherry picked from commit 617f4cc) Co-authored-by: Tadej Magajna <tmagajna@gmail.com> Co-authored-by: Victor Stinner <vstinner@python.org>

…er doc (python#143395) Co-authored-by: Victor Stinner <vstinner@python.org>

pythongh-142533: Document CRLF injection vulnerability in http.server…
b1edcf8
… and wsgiref modules

bedevere-appBot mentioned this pull request Jan 3, 2026
Document CRLF handling for http.server#142533
Closed

bedevere-appBot added awaiting review docs Documentation in the Doc dir labels Jan 3, 2026

github-project-automationBot added this to Docs PRs Jan 3, 2026

github-project-automationBot moved this to Todo in Docs PRs Jan 3, 2026

picnixz self-requested a review January 4, 2026 01:15

pythongh-142533: Remove reduntant NEWS entry
39c5198

picnixz added the skip news label Jan 4, 2026

picnixz reviewed Jan 4, 2026
View reviewed changes

pythongh-142533: Ensure CRLF is mentioned in the security considerati…
2751d9b
…on section only

picnixz reviewed Jan 4, 2026
View reviewed changes

pythongh-142533: Added label and spacing
d88da64

tadejmagajna requested a review from picnixz January 6, 2026 23:12

vstinner previously approved these changes Jan 19, 2026
View reviewed changes

bedevere-appBot added awaiting merge and removed awaiting review labels Jan 19, 2026

picnixz approved these changes Jan 19, 2026
View reviewed changes

hugovk added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Mar 11, 2026

vstinner reviewed Mar 11, 2026
View reviewed changes

tadejmagajna added 2 commits April 1, 2026 23:09

Merge branch 'main' intopythongh-142533-document-server-header-vulne…
57ff6a9
…rability

pythongh-142533: Remove vulnerability warnings from wsgiref module do…
0be4e58
…cumentation since the issue was recently fixed

tadejmagajna requested a review from vstinner April 1, 2026 21:22

vstinner reviewed Apr 1, 2026
View reviewed changes

tadejmagajnaand others added 2 commits April 2, 2026 21:24

Accept commit suggestion reg. http header reference
3f8dd05
Co-authored-by: Victor Stinner <vstinner@python.org>

pythongh-142533: Document CRLF vulnerability also for send_response_only
eb4fbfb

tadejmagajna requested a review from vstinner April 2, 2026 19:41

vstinner approved these changes Apr 2, 2026
View reviewed changes

vstinner merged commit 617f4cc into python:mainApr 2, 2026
30 checks passed

github-project-automationBot moved this from Todo to Done in Docs PRs Apr 2, 2026

bedevere-appBot removed the awaiting merge label Apr 2, 2026

bedevere-appBot removed the needs backport to 3.14 bugs and security fixes label Apr 2, 2026

bedevere-appBot removed the needs backport to 3.13 bugs and security fixes label Apr 2, 2026

pablogsal mentioned this pull request Apr 4, 2026
gh-130273: Fix traceback color output with unicode characters #142529
Merged

tadejmagajna deleted the gh-142533-document-server-header-vulnerability branch April 22, 2026 21:14

ljfp pushed a commit to ljfp/cpython that referenced this pull request Apr 25, 2026
pythongh-142533: Document CRLF injection vulnerabilities in http.serv…
306b84e
…er doc (python#143395) Co-authored-by: Victor Stinner <vstinner@python.org>

coderabbitaiBot mentioned this pull request Jul 15, 2026
feat(browser): dispatch authenticated Sol Pro work packages (#2913) Sinity/polylogue#2913
Merged


		Content-Disposition: attachment; filename="bud.gif"

		This method does not reject input containing CRLF sequences.

		Security considerations
		-----------------------

Uh oh!

Uh oh!

Conversation

tadejmagajna commented Jan 3, 2026• edited by github-actions BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aisk commented Jan 4, 2026

Uh oh!

picnixzJan 4, 2026

Choose a reason for hiding this comment

Uh oh!

tadejmagajnaJan 4, 2026

Choose a reason for hiding this comment

Uh oh!

picnixzJan 4, 2026

Choose a reason for hiding this comment

Uh oh!

picnixzJan 4, 2026

Choose a reason for hiding this comment

Uh oh!

tadejmagajna commented Jan 17, 2026

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

vstinner commented Jan 19, 2026

Uh oh!

tadejmagajna commented Mar 10, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinnerMar 11, 2026

Choose a reason for hiding this comment

Uh oh!

tadejmagajnaApr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

vstinnerApr 1, 2026

Choose a reason for hiding this comment

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington-appBot commented Apr 2, 2026

Uh oh!

bedevere-appBot commented Apr 2, 2026

Uh oh!

bedevere-appBot commented Apr 2, 2026

Uh oh!

vstinner commented Apr 2, 2026

Uh oh!

vstinner commented Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

tadejmagajna commented Jan 3, 2026•
edited by github-actions Bot
Loading

tadejmagajna commented Mar 10, 2026•
edited
Loading