Skip to content

gh-146211: Reject CR/LF in HTTP tunnel request headers - #146212

Merged
sethmlarson merged 6 commits into
python:mainfrom
sethmlarson:http-client-proxy-tunnel
Apr 10, 2026
Merged

gh-146211: Reject CR/LF in HTTP tunnel request headers#146212
sethmlarson merged 6 commits into
python:mainfrom
sethmlarson:http-client-proxy-tunnel

Conversation

@sethmlarson

@sethmlarsonsethmlarson commented Mar 20, 2026•
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

@sethmlarsonsethmlarson added the type-security A security issue label Mar 20, 2026
@bedevere-appbedevere-appBot mentioned this pull request Mar 20, 2026
Closed
@sethmlarson

sethmlarson commented Mar 20, 2026

Copy link
Copy Markdown
ContributorAuthor

(Android failure looks unrelated? https://github.com/python/cpython/actions/runs/23347514549/job/67916875598?pr=146212)

@sethmlarson
sethmlarson requested a review from ambvMarch 25, 2026 22:19
illia-v
illia-v reviewed Apr 3, 2026
View reviewed changes

@illia-villia-v left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍🏻
I left one minor suggestion about the _tunnel_host error message

Comment threadLib/http/client.py Outdated
@sethmlarson

sethmlarson commented Apr 10, 2026

Copy link
Copy Markdown
ContributorAuthor

I'm going to move forward with a merge, as I'm not sure there are folks who have looked at http.client more recently than @illia-v and I.

@sethmlarson
sethmlarson merged commit 05ed7ce into python:mainApr 10, 2026
54 checks passed
@sethmlarson
sethmlarson deleted the http-client-proxy-tunnel branch April 10, 2026 15:21
@sethmlarsonsethmlarson added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 10, 2026
@miss-islington-app

miss-islington-appBot commented Apr 10, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

@miss-islington-app

miss-islington-appBot commented Apr 10, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-appBot commented Apr 10, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-appBot commented Apr 10, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-appBot commented Apr 10, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-appBot commented Apr 10, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69 3.10

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 10, 2026
@sethmlarson@illia-v@miss-islington
pythongh-146211: Reject CR/LF in HTTP tunnel request headers (pythonG…
9e0d321
…H-146212)
(cherry picked from commit 05ed7ce)
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
@bedevere-app

bedevere-appBot commented Apr 10, 2026

Copy link
Copy Markdown

GH-148341 is a backport of this pull request to the 3.12 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.12 only security fixes label Apr 10, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 10, 2026
@sethmlarson@illia-v@miss-islington
pythongh-146211: Reject CR/LF in HTTP tunnel request headers (pythonG…
afdd351
…H-146212)
(cherry picked from commit 05ed7ce)
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
@bedevere-app

bedevere-appBot commented Apr 10, 2026

Copy link
Copy Markdown

GH-148342 is a backport of this pull request to the 3.14 branch.

@miss-islington-app

miss-islington-appBot commented Apr 10, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69 3.11

@bedevere-appbedevere-appBot removed the needs backport to 3.14 bugs and security fixes label Apr 10, 2026
@bedevere-app

bedevere-appBot commented Apr 10, 2026

Copy link
Copy Markdown

GH-148343 is a backport of this pull request to the 3.13 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.13 bugs and security fixes label Apr 10, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 10, 2026
@sethmlarson@illia-v@miss-islington
pythongh-146211: Reject CR/LF in HTTP tunnel request headers (pythonG…
c3f2505
…H-146212)
(cherry picked from commit 05ed7ce)
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Apr 10, 2026
@sethmlarson@illia-v
[3.10]pythongh-146211: Reject CR/LF in HTTP tunnel request headers (p…
fb7005a
…ythonGH-146212)
(cherry picked from commit 05ed7ce)
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
@bedevere-app

bedevere-appBot commented Apr 10, 2026

Copy link
Copy Markdown

GH-148350 is a backport of this pull request to the 3.10 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.10 only security fixes label Apr 10, 2026
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Apr 10, 2026
@sethmlarson@illia-v
[3.11]pythongh-146211: Reject CR/LF in HTTP tunnel request headers (p…
0431983
…ythonGH-146212)
(cherry picked from commit 05ed7ce)
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
@bedevere-app

bedevere-appBot commented Apr 10, 2026

Copy link
Copy Markdown

GH-148351 is a backport of this pull request to the 3.11 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.11 only security fixes label Apr 10, 2026
mandree added a commit to mandree/freebsd-ports that referenced this pull request Apr 11, 2026
@mandree
lang/python314: security update to 3.14.4
b526f87
Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.
Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.
Changelog:	https://docs.python.org/release/3.14.4/whatsnew/changelog.html
Which contains these security fixes:
pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:	python/cpython#145986
which is the same as
Security:	CVE-2026-4224
Reject control characters in more places in http.cookies.Morsel
Security:	python/cpython#145599
which is the same as
Security:	CVE-2026-3644
SourcelessFileLoader does not use io.open_code()
Security:	python/cpython#145506
which is the same as
Security:	CVE-2026-2297
[security] Disallow usage of control characters in status, headers and
values for security in Lib/wsgiref/handlers.py
Security:	python/cpython#144370
Reject leading dashes in webbrowser.open()
Security:	python/cpython#143930
which is the same as
Security:	9fdad262-2e0f-11f1-88c7-00a098b42aeb
which is the same as
Security:	CVE-2026-4519
Excess Base64 data ignored after padding by default
Security:	python/cpython#145264
which is the same as
Security:	CVE-2026-3446
Added into PORTREVISION=1: 2 cherry-picks post-3.14.4
HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF
Obtained from:	python/cpython#148342
Security:	python/cpython#146212
Security:	CVE-2026-1502
configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to
quadratic backtracking
Obtained from:	python/cpython#148287
Security:	python/cpython#146333
lang/python314: add FULLLTO and warning
mandree added a commit to mandree/freebsd-ports that referenced this pull request Apr 11, 2026
@mandree
lang/python314: security update to 3.14.4
62a66cb
Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.
Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.
Changelog:	https://docs.python.org/release/3.14.4/whatsnew/changelog.html
Which contains these security fixes:
pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:	python/cpython#145986
which is the same as
Security:	CVE-2026-4224
Reject control characters in more places in http.cookies.Morsel
Security:	python/cpython#145599
which is the same as
Security:	CVE-2026-3644
SourcelessFileLoader does not use io.open_code()
Security:	python/cpython#145506
which is the same as
Security:	CVE-2026-2297
[security] Disallow usage of control characters in status, headers and
values for security in Lib/wsgiref/handlers.py
Security:	python/cpython#144370
Reject leading dashes in webbrowser.open()
Security:	python/cpython#143930
which is the same as
Security:	9fdad262-2e0f-11f1-88c7-00a098b42aeb
which is the same as
Security:	CVE-2026-4519
Excess Base64 data ignored after padding by default
Security:	python/cpython#145264
which is the same as
Security:	CVE-2026-3446
Added into PORTREVISION=1: 2 cherry-picks post-3.14.4
HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF
Obtained from:	python/cpython#148342
Security:	python/cpython#146212
Security:	CVE-2026-1502
configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to
quadratic backtracking
Obtained from:	python/cpython#148287
Security:	python/cpython#146333
lang/python314: add FULLLTO and warning
(cherry picked from commit b526f87)
freebsd-git pushed a commit to freebsd/freebsd-ports that referenced this pull request Apr 12, 2026
@mandreeDaniel Engberg
lang/python314: Security update to 3.14.4
955268b
Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.
Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.
Changelog:	https://docs.python.org/release/3.14.4/whatsnew/changelog.html
PR: 294324
Which contains these security fixes:
pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:	python/cpython#145986
/ CVE-2026-4224
Reject control characters in more places in http.cookies.Morsel
Security:	python/cpython#145599
/ CVE-2026-3644
SourcelessFileLoader does not use io.open_code()
Security:	python/cpython#145506
/ CVE-2026-2297
Disallow usage of control characters in status, headers and
values for security in Lib/wsgiref/handlers.py
Security:	python/cpython#144370
Reject leading dashes in webbrowser.open()
Security:	python/cpython#143930
/ 9fdad262-2e0f-11f1-88c7-00a098b42aeb
/ CVE-2026-4519
Excess Base64 data ignored after padding by default
Security:	python/cpython#145264
/ CVE-2026-3446
Additional security related PRs from upstream
HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF
Obtained from:	python/cpython#148342
Security	python/cpython#146212
/ CVE-2026-1502
configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to
quadratic backtracking
Obtained from:	python/cpython#148287
Security:	python/cpython#146333
freebsd-git pushed a commit to freebsd/freebsd-ports that referenced this pull request Apr 12, 2026
@mandreeDaniel Engberg
lang/python314: Security update to 3.14.4
cb35b3d
Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.
Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.
Changelog:	https://docs.python.org/release/3.14.4/whatsnew/changelog.html
PR: 294324
Which contains these security fixes:
pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:	python/cpython#145986
/ CVE-2026-4224
Reject control characters in more places in http.cookies.Morsel
Security:	python/cpython#145599
/ CVE-2026-3644
SourcelessFileLoader does not use io.open_code()
Security:	python/cpython#145506
/ CVE-2026-2297
Disallow usage of control characters in status, headers and
values for security in Lib/wsgiref/handlers.py
Security:	python/cpython#144370
Reject leading dashes in webbrowser.open()
Security:	python/cpython#143930
/ 9fdad262-2e0f-11f1-88c7-00a098b42aeb
/ CVE-2026-4519
Excess Base64 data ignored after padding by default
Security:	python/cpython#145264
/ CVE-2026-3446
Additional security related PRs from upstream
HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF
Obtained from:	python/cpython#148342
Security	python/cpython#146212
/ CVE-2026-1502
configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to
quadratic backtracking
Obtained from:	python/cpython#148287
Security:	python/cpython#146333
(cherry picked from commit 955268b)
@UTsweetyfishUTsweetyfish mentioned this pull request Apr 13, 2026
Closed
Dustin4444

This comment was marked as spam.

Sign in to view

hugovk pushed a commit that referenced this pull request Apr 21, 2026
@miss-islington@sethmlarson@illia-v
[3.14]gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212
b1cf901
) (#148342)
gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)
(cherry picked from commit 05ed7ce)
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
ljfp pushed a commit to ljfp/cpython that referenced this pull request Apr 25, 2026
@sethmlarson@illia-v@ljfp
pythongh-146211: Reject CR/LF in HTTP tunnel request headers (python#…
2e5fe78
…146212)
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
Yhg1s pushed a commit that referenced this pull request May 18, 2026
@miss-islington@sethmlarson@illia-v
[3.13]gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212
9e071c9
) (#148343)
gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)
(cherry picked from commit 05ed7ce)
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
Yhg1s pushed a commit that referenced this pull request May 18, 2026
@miss-islington@sethmlarson@illia-v
[3.12]gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212
c00c386
) (#148341)
gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)
(cherry picked from commit 05ed7ce)
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
pablogsal pushed a commit that referenced this pull request Jun 27, 2026
@sethmlarson@illia-v
[3.11]gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146… (
56b7100
#148351)
[3.11] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)
(cherry picked from commit 05ed7ce)
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
pablogsal pushed a commit that referenced this pull request Jun 27, 2026
@sethmlarson@illia-v
[3.10]gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146… (
58703ec
#148350)
[3.10] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)
(cherry picked from commit 05ed7ce)
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
camachat pushed a commit to camachat/freebsd-ports that referenced this pull request Jul 22, 2026
@mandreeDaniel Engberg
lang/python314: Security update to 3.14.4
7b1d556
Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.
Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.
Changelog:	https://docs.python.org/release/3.14.4/whatsnew/changelog.html
PR: 294324
Which contains these security fixes:
pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:	python/cpython#145986
/ CVE-2026-4224
Reject control characters in more places in http.cookies.Morsel
Security:	python/cpython#145599
/ CVE-2026-3644
SourcelessFileLoader does not use io.open_code()
Security:	python/cpython#145506
/ CVE-2026-2297
Disallow usage of control characters in status, headers and
values for security in Lib/wsgiref/handlers.py
Security:	python/cpython#144370
Reject leading dashes in webbrowser.open()
Security:	python/cpython#143930
/ 9fdad262-2e0f-11f1-88c7-00a098b42aeb
/ CVE-2026-4519
Excess Base64 data ignored after padding by default
Security:	python/cpython#145264
/ CVE-2026-3446
Additional security related PRs from upstream
HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF
Obtained from:	python/cpython#148342
Security	python/cpython#146212
/ CVE-2026-1502
configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to
quadratic backtracking
Obtained from:	python/cpython#148287
Security:	python/cpython#146333
camachat pushed a commit to camachat/freebsd-ports that referenced this pull request Jul 24, 2026
@mandreeDaniel Engberg
lang/python314: Security update to 3.14.4
ec484f0
Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.
Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.
Changelog:	https://docs.python.org/release/3.14.4/whatsnew/changelog.html
PR: 294324
Which contains these security fixes:
pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:	python/cpython#145986
/ CVE-2026-4224
Reject control characters in more places in http.cookies.Morsel
Security:	python/cpython#145599
/ CVE-2026-3644
SourcelessFileLoader does not use io.open_code()
Security:	python/cpython#145506
/ CVE-2026-2297
Disallow usage of control characters in status, headers and
values for security in Lib/wsgiref/handlers.py
Security:	python/cpython#144370
Reject leading dashes in webbrowser.open()
Security:	python/cpython#143930
/ 9fdad262-2e0f-11f1-88c7-00a098b42aeb
/ CVE-2026-4519
Excess Base64 data ignored after padding by default
Security:	python/cpython#145264
/ CVE-2026-3446
Additional security related PRs from upstream
HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF
Obtained from:	python/cpython#148342
Security	python/cpython#146212
/ CVE-2026-1502
configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to
quadratic backtracking
Obtained from:	python/cpython#148287
Security:	python/cpython#146333
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@serhiy-storchakaserhiy-storchakaAwaiting requested review from serhiy-storchaka
@ambvambvAwaiting requested review from ambv
2 more reviewers
@illia-villia-villia-v left review comments
@Dustin4444Dustin4444Dustin4444 left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@sethmlarsonsethmlarson

Labels

type-securityA security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@sethmlarson@illia-v@Dustin4444