Commit b526f87

PYTHON_DISTVERSION= 3.14.4

TIMESTAMP = 1775640582

SHA256 (python/Python-3.14.4.tar.xz) = d923c51303e38e249136fc1bdf3568d56ecb03214efdef48516176d3d7faaef8

SIZE (python/Python-3.14.4.tar.xz) = 23855332

From afdd351544e8112d4070a31f2218f99256697472 Mon Sep 17 00:00:00 2001

From: Seth Larson <seth@python.org>

Date: Fri, 10 Apr 2026 10:21:42 -0500

Subject: [PATCH] gh-146211: Reject CR/LF in HTTP tunnel request headers

(GH-146212) (cherry picked from commit

05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69)

Co-authored-by: Seth Larson <seth@python.org>

Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

---

Lib/http/client.py | 11 ++++-

Lib/test/test_httplib.py | 45 +++++++++++++++++++

...-03-20-09-29-42.gh-issue-146211.PQVbs7.rst | 2 +

3 files changed, 57 insertions(+), 1 deletion(-)

create mode 100644 Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst

diff --git a/Lib/http/client.py b/Lib/http/client.py

index 77f8d26291dfc2..6fb7d254ea9c27 100644

--- ./Lib/http/client.py

+++ b/Lib/http/client.py

@@ -972,13 +972,22 @@ def _wrap_ipv6(self, ip):

return ip

def _tunnel(self):

+ if _contains_disallowed_url_pchar_re.search(self._tunnel_host):

+ raise ValueError('Tunnel host can\'t contain control characters %r'

+ % (self._tunnel_host,))

connect = b"CONNECT %s:%d %s\r\n" % (

self._wrap_ipv6(self._tunnel_host.encode("idna")),

self._tunnel_port,

self._http_vsn_str.encode("ascii"))

headers = [connect]

for header, value in self._tunnel_headers.items():

- headers.append(f"{header}: {value}\r\n".encode("latin-1"))

+ header_bytes = header.encode("latin-1")

+ value_bytes = value.encode("latin-1")

+ if not _is_legal_header_name(header_bytes):

+ raise ValueError('Invalid header name %r' % (header_bytes,))

+ if _is_illegal_header_value(value_bytes):

+ raise ValueError('Invalid header value %r' % (value_bytes,))

+ headers.append(b"%s: %s\r\n" % (header_bytes, value_bytes))

headers.append(b"\r\n")

# Making a single send() call instead of one per line encourages

# the host OS to use a more optimal packet size instead of

diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py

index bcb828edec7c39..6f3eac6b98a4de 100644

--- ./Lib/test/test_httplib.py

+++ b/Lib/test/test_httplib.py

@@ -369,6 +369,51 @@ def test_invalid_headers(self):

with self.assertRaisesRegex(ValueError, 'Invalid header'):

conn.putheader(name, value)

+ def test_invalid_tunnel_headers(self):

+ cases = (

+ ('Invalid\r\nName', 'ValidValue'),

+ ('Invalid\rName', 'ValidValue'),

+ ('Invalid\nName', 'ValidValue'),

+ ('\r\nInvalidName', 'ValidValue'),

+ ('\rInvalidName', 'ValidValue'),

+ ('\nInvalidName', 'ValidValue'),

+ (' InvalidName', 'ValidValue'),

+ ('\tInvalidName', 'ValidValue'),

+ ('Invalid:Name', 'ValidValue'),

+ (':InvalidName', 'ValidValue'),

+ ('ValidName', 'Invalid\r\nValue'),

+ ('ValidName', 'Invalid\rValue'),

+ ('ValidName', 'Invalid\nValue'),

+ ('ValidName', 'InvalidValue\r\n'),

+ ('ValidName', 'InvalidValue\r'),

+ ('ValidName', 'InvalidValue\n'),

+ )

+ for name, value in cases:

+ with self.subTest((name, value)):

+ conn = client.HTTPConnection('example.com')

+ conn.set_tunnel('tunnel', headers={

+ name: value

+ })

+ conn.sock = FakeSocket('')

+ with self.assertRaisesRegex(ValueError, 'Invalid header'):

+ conn._tunnel() # Called in .connect()

+

+ def test_invalid_tunnel_host(self):

+ cases = (

+ 'invalid\r.host',

+ '\ninvalid.host',

+ 'invalid.host\r\n',

+ 'invalid.host\x00',

+ 'invalid host',

+ )

+ for tunnel_host in cases:

+ with self.subTest(tunnel_host):

+ conn = client.HTTPConnection('example.com')

+ conn.set_tunnel(tunnel_host)

+ conn.sock = FakeSocket('')

+ with self.assertRaisesRegex(ValueError, 'Tunnel host can\'t contain control characters'):

+ conn._tunnel() # Called in .connect()

+

def test_headers_debuglevel(self):

body = (

b'HTTP/1.1 200 OK\r\n'

diff --git a/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst

new file mode 100644

index 00000000000000..4993633b8ebebb

--- /dev/null

+++ ./Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst

@@ -0,0 +1,2 @@

+Reject CR/LF characters in tunnel request headers for the

+HTTPConnection.set_tunnel() method.

From ab8704a8e05e2f926c10f994e4085e8726048fa4 Mon Sep 17 00:00:00 2001

From: Joshua Swanson <22283299+joshuaswanson@users.noreply.github.com>

Date: Tue, 7 Apr 2026 16:10:34 +0200

Subject: [PATCH] gh-146333: Fix quadratic regex backtracking in configparser

option parsing (GH-146399)

Use negative lookahead in option regex to prevent backtracking, and to avoid changing logic outside the regexes (since people could use the regex directly).

(cherry picked from commit 7e0a0be4097f9d29d66fe23f5af86f18a34ed7dd)

Co-authored-by: Joshua Swanson <22283299+joshuaswanson@users.noreply.github.com>

---

Lib/configparser.py | 8 ++++++--

Lib/test/test_configparser.py | 20 +++++++++++++++++++

...3-25-00-51-03.gh-issue-146333.LqdL__bn.rst | 3 +++

3 files changed, 29 insertions(+), 2 deletions(-)

create mode 100644 Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst

diff --git a/Lib/configparser.py b/Lib/configparser.py

index d435a5c2fe0da2..e76647d339e913 100644

--- ./Lib/configparser.py

+++ b/Lib/configparser.py

@@ -613,7 +613,9 @@ class RawConfigParser(MutableMapping):

\] # ]

"""

_OPT_TMPL = r"""

- (?P<option>.*?) # very permissive!

+ (?P<option> # very permissive!

+ (?:(?!{delim})\S)* # non-delimiter non-whitespace

+ (?:\s+(?:(?!{delim})\S)+)*) # optionally more words

\s*(?P<vi>{delim})\s* # any number of space/tab,

# followed by any of the

# allowed delimiters,

@@ -621,7 +623,9 @@ class RawConfigParser(MutableMapping):

(?P<value>.*)$ # everything up to eol

"""

_OPT_NV_TMPL = r"""

- (?P<option>.*?) # very permissive!

+ (?P<option> # very permissive!

+ (?:(?!{delim})\S)* # non-delimiter non-whitespace

+ (?:\s+(?:(?!{delim})\S)+)*) # optionally more words

\s*(?: # any number of space/tab,

(?P<vi>{delim})\s* # optionally followed by

# any of the allowed

diff --git a/Lib/test/test_configparser.py b/Lib/test/test_configparser.py

index 1bfb53ccbb1398..d7c4f19c1a5ef0 100644

--- ./Lib/test/test_configparser.py

+++ b/Lib/test/test_configparser.py

@@ -2270,6 +2270,26 @@ def test_section_bracket_in_key(self):

output.close()

+class ReDoSTestCase(unittest.TestCase):

+ """Regression tests for quadratic regex backtracking (gh-146333)."""

+

+ def test_option_regex_does_not_backtrack(self):

+ # A line with many spaces between non-delimiter characters

+ # should be parsed in linear time, not quadratic.

+ parser = configparser.RawConfigParser()

+ content = "[section]\n" + "x" + " " * 40000 + "y" + "\n"

+ # This should complete almost instantly. Before the fix,

+ # it would take over a minute due to catastrophic backtracking.

+ with self.assertRaises(configparser.ParsingError):

+ parser.read_string(content)

+

+ def test_option_regex_no_value_does_not_backtrack(self):

+ parser = configparser.RawConfigParser(allow_no_value=True)

+ content = "[section]\n" + "x" + " " * 40000 + "y" + "\n"

+ parser.read_string(content)

+ self.assertTrue(parser.has_option("section", "x" + " " * 40000 + "y"))

+

+

class MiscTestCase(unittest.TestCase):

def test__all__(self):

support.check__all__(self, configparser, not_exported={"Error"})

diff --git a/Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst b/Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst

new file mode 100644

index 00000000000000..96d86ecc0a0fb3

--- /dev/null

+++ ./Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst

@@ -0,0 +1,3 @@

+Fix quadratic backtracking in :class:`configparser.RawConfigParser` option

+parsing regexes (``OPTCRE`` and ``OPTCRE_NV``). A crafted configuration line

+with many whitespace characters could cause excessive CPU usage.

lib/python%%XYDOT%%/ensurepip/_bundled/pip-26.0.1-py3-none-any.whl

lib/python%%XYDOT%%/test/__pycache__/mp_preload_large_sysargv.cpython-%%XY%%.opt-1.pyc

lib/python%%XYDOT%%/test/__pycache__/mp_preload_large_sysargv.cpython-%%XY%%.opt-2.pyc

lib/python%%XYDOT%%/test/__pycache__/mp_preload_large_sysargv.cpython-%%XY%%.pyc

lib/python%%XYDOT%%/test/mp_preload_large_sysargv.py

lib/python%%XYDOT%%/test/test_free_threading/__pycache__/test_collections.cpython-%%XY%%.opt-1.pyc

lib/python%%XYDOT%%/test/test_free_threading/__pycache__/test_collections.cpython-%%XY%%.opt-2.pyc

lib/python%%XYDOT%%/test/test_free_threading/__pycache__/test_collections.cpython-%%XY%%.pyc

lib/python%%XYDOT%%/test/test_free_threading/__pycache__/test_frame.cpython-%%XY%%.opt-1.pyc

lib/python%%XYDOT%%/test/test_free_threading/__pycache__/test_frame.cpython-%%XY%%.opt-2.pyc

lib/python%%XYDOT%%/test/test_free_threading/__pycache__/test_frame.cpython-%%XY%%.pyc

lib/python%%XYDOT%%/test/test_free_threading/test_collections.py

lib/python%%XYDOT%%/test/test_free_threading/test_frame.py

lib/python%%XYDOT%%/test/test_tools/__pycache__/test_compute_changes.cpython-%%XY%%.opt-1.pyc

lib/python%%XYDOT%%/test/test_tools/__pycache__/test_compute_changes.cpython-%%XY%%.opt-2.pyc

lib/python%%XYDOT%%/test/test_tools/__pycache__/test_compute_changes.cpython-%%XY%%.pyc

lib/python%%XYDOT%%/test/test_tools/test_compute_changes.py