Skip to content

HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF #146211

Closed
Closed
HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF#146211
Labels
3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Description

@sethmlarson
sethmlarson
opened on Mar 20, 2026

Bug report

Bug description:

HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF. Should sanitize the input of .set_tunnel() to avoid header splitting.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Other, Linux

Linked PRs

Activity

  1. sethmlarson
    added
    type-bugAn unexpected behavior, bug, or error
    type-securityA security issue
    on Mar 20, 2026
  2. sethmlarson
    added a commit that references this issue on Mar 20, 2026

    pythongh-146211: Reject CR/LF in HTTP tunnel request headers

    1703bdd
  3. StanFromIreland
    added
    stdlibStandard Library Python modules in the Lib/ directory
    3.11only security fixes
    3.10 (EOL)end of life
    3.12only security fixes
    3.13only security fixes
    3.14bugs and security fixes
    3.15bugs and security fixes
    and removed
    type-bugAn unexpected behavior, bug, or error
    on Mar 20, 2026
  4. sethmlarson
    added a commit that references this issue on Apr 10, 2026

    gh-146211: Reject CR/LF in HTTP tunnel request headers (#146212)

    05ed7ce
  5. miss-islington
    added 3 commits that reference this issue on Apr 10, 2026

    pythongh-146211: Reject CR/LF in HTTP tunnel request headers (pythonG…

    9e0d321

    pythongh-146211: Reject CR/LF in HTTP tunnel request headers (pythonG…

    afdd351

    pythongh-146211: Reject CR/LF in HTTP tunnel request headers (pythonG…

    c3f2505

  6. 11 remaining items

  7. Yhg1s
    added 2 commits that reference this issue on May 18, 2026

    [3.13] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212

    9e071c9

    [3.12] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212

    c00c386
  8. bmwiedemann
    added a commit that references this issue on Jun 22, 2026

    Update python312 to version 3.12.13 / rev 49 via SR 1360565

    0e1eb21
  9. illia-v
    added a commit that references this issue on Jun 24, 2026

    Port "Reject CR/LF in HTTP tunnel request headers"

    006263c
  10. pablogsal
    added 2 commits that reference this issue on Jun 27, 2026

    [3.11] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146… (

    56b7100

    [3.10] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146… (

    58703ec
  11. serhiy-storchaka
    closed this as completedon Jul 3, 2026
  12. illia-v
    added a commit that references this issue on Jul 5, 2026

    Port "Reject CR/LF in HTTP tunnel request headers" (#5091)

    e18a0d1
  13. arnout
    added a commit that references this issue on Aug 14, 2026

    package/python3: security bump to v3.12.14

    80251a0
  14. mcepl
    added 3 commits that reference this issue on Sep 18, 2026

    [CVE-2026-1502] Reject CR/LF in HTTP tunnel request headers

    7134503

    [CVE-2026-1502] Reject CR/LF in HTTP tunnel request headers

    dc97717

    [CVE-2026-1502] Reject CR/LF in HTTP tunnel request headers

    864be9d
  15. mcepl
    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-1502] Reject CR/LF in HTTP tunnel request headers

    b52335b

    [CVE-2026-1502] Reject CR/LF in HTTP tunnel request headers

    2ef408f

    [CVE-2026-1502] Reject CR/LF in HTTP tunnel request headers

    4d1cf9f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions