gh-146211: Reject CR/LF in HTTP tunnel request headers by sethmlarson · Pull Request #146212 · python/cpython

sethmlarson · 2026-03-20T14:31:12Z

Issue: HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF #146211

sethmlarson · 2026-03-20T14:40:29Z

(Android failure looks unrelated? https://github.com/python/cpython/actions/runs/23347514549/job/67916875598?pr=146212)

illia-v

LGTM 👍🏻
I left one minor suggestion about the _tunnel_host error message

Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

sethmlarson · 2026-04-10T15:21:39Z

I'm going to move forward with a merge, as I'm not sure there are folks who have looked at http.client more recently than @illia-v and I.

miss-islington-app · 2026-04-10T15:43:56Z

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

miss-islington-app · 2026-04-10T15:43:56Z

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

miss-islington-app · 2026-04-10T15:43:56Z

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

miss-islington-app · 2026-04-10T15:43:56Z

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

miss-islington-app · 2026-04-10T15:43:56Z

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington-app · 2026-04-10T15:43:59Z

Sorry, @sethmlarson, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69 3.10

…H-146212) (cherry picked from commit 05ed7ce) Co-authored-by: Seth Larson <seth@python.org> Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

bedevere-app · 2026-04-10T15:44:14Z

GH-148342 is a backport of this pull request to the 3.14 branch.

miss-islington-app · 2026-04-10T15:44:15Z

Sorry, @sethmlarson, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69 3.11

bedevere-app · 2026-04-10T15:44:25Z

GH-148343 is a backport of this pull request to the 3.13 branch.

…H-146212) (cherry picked from commit 05ed7ce) Co-authored-by: Seth Larson <seth@python.org> Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

…ythonGH-146212) (cherry picked from commit 05ed7ce) Co-authored-by: Seth Larson <seth@python.org> Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

bedevere-app · 2026-04-10T16:57:52Z

GH-148350 is a backport of this pull request to the 3.10 branch.

…ythonGH-146212) (cherry picked from commit 05ed7ce) Co-authored-by: Seth Larson <seth@python.org> Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

bedevere-app · 2026-04-10T16:59:17Z

GH-148351 is a backport of this pull request to the 3.11 branch.

Add a -flto=full option, which can speed up the port build in terms of wallclock time at the expense of overall more CPU time. Issue a warning that test_ssl will fail from pre-test if DEBUG is enabled. Changelog: https://docs.python.org/release/3.14.4/whatsnew/changelog.html Which contains these security fixes: pyexpat.c: Unbounded C recursion in conv_content_model causes crash Security: python/cpython#145986 which is the same as Security: CVE-2026-4224 Reject control characters in more places in http.cookies.Morsel Security: python/cpython#145599 which is the same as Security: CVE-2026-3644 SourcelessFileLoader does not use io.open_code() Security: python/cpython#145506 which is the same as Security: CVE-2026-2297 [security] Disallow usage of control characters in status, headers and values for security in Lib/wsgiref/handlers.py Security: python/cpython#144370 Reject leading dashes in webbrowser.open() Security: python/cpython#143930 which is the same as Security: 9fdad262-2e0f-11f1-88c7-00a098b42aeb which is the same as Security: CVE-2026-4519 Excess Base64 data ignored after padding by default Security: python/cpython#145264 which is the same as Security: CVE-2026-3446 Added into PORTREVISION=1: 2 cherry-picks post-3.14.4 HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF Obtained from: python/cpython#148342 Security: python/cpython#146212 Security: CVE-2026-1502 configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to quadratic backtracking Obtained from: python/cpython#148287 Security: python/cpython#146333 lang/python314: add FULLLTO and warning

Add a -flto=full option, which can speed up the port build in terms of wallclock time at the expense of overall more CPU time. Issue a warning that test_ssl will fail from pre-test if DEBUG is enabled. Changelog: https://docs.python.org/release/3.14.4/whatsnew/changelog.html Which contains these security fixes: pyexpat.c: Unbounded C recursion in conv_content_model causes crash Security: python/cpython#145986 which is the same as Security: CVE-2026-4224 Reject control characters in more places in http.cookies.Morsel Security: python/cpython#145599 which is the same as Security: CVE-2026-3644 SourcelessFileLoader does not use io.open_code() Security: python/cpython#145506 which is the same as Security: CVE-2026-2297 [security] Disallow usage of control characters in status, headers and values for security in Lib/wsgiref/handlers.py Security: python/cpython#144370 Reject leading dashes in webbrowser.open() Security: python/cpython#143930 which is the same as Security: 9fdad262-2e0f-11f1-88c7-00a098b42aeb which is the same as Security: CVE-2026-4519 Excess Base64 data ignored after padding by default Security: python/cpython#145264 which is the same as Security: CVE-2026-3446 Added into PORTREVISION=1: 2 cherry-picks post-3.14.4 HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF Obtained from: python/cpython#148342 Security: python/cpython#146212 Security: CVE-2026-1502 configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to quadratic backtracking Obtained from: python/cpython#148287 Security: python/cpython#146333 lang/python314: add FULLLTO and warning (cherry picked from commit b526f87)

Add a -flto=full option, which can speed up the port build in terms of wallclock time at the expense of overall more CPU time. Issue a warning that test_ssl will fail from pre-test if DEBUG is enabled. Changelog: https://docs.python.org/release/3.14.4/whatsnew/changelog.html PR: 294324 Which contains these security fixes: pyexpat.c: Unbounded C recursion in conv_content_model causes crash Security: python/cpython#145986 / CVE-2026-4224 Reject control characters in more places in http.cookies.Morsel Security: python/cpython#145599 / CVE-2026-3644 SourcelessFileLoader does not use io.open_code() Security: python/cpython#145506 / CVE-2026-2297 Disallow usage of control characters in status, headers and values for security in Lib/wsgiref/handlers.py Security: python/cpython#144370 Reject leading dashes in webbrowser.open() Security: python/cpython#143930 / 9fdad262-2e0f-11f1-88c7-00a098b42aeb / CVE-2026-4519 Excess Base64 data ignored after padding by default Security: python/cpython#145264 / CVE-2026-3446 Additional security related PRs from upstream HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF Obtained from: python/cpython#148342 Security python/cpython#146212 / CVE-2026-1502 configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to quadratic backtracking Obtained from: python/cpython#148287 Security: python/cpython#146333

Add a -flto=full option, which can speed up the port build in terms of wallclock time at the expense of overall more CPU time. Issue a warning that test_ssl will fail from pre-test if DEBUG is enabled. Changelog: https://docs.python.org/release/3.14.4/whatsnew/changelog.html PR: 294324 Which contains these security fixes: pyexpat.c: Unbounded C recursion in conv_content_model causes crash Security: python/cpython#145986 / CVE-2026-4224 Reject control characters in more places in http.cookies.Morsel Security: python/cpython#145599 / CVE-2026-3644 SourcelessFileLoader does not use io.open_code() Security: python/cpython#145506 / CVE-2026-2297 Disallow usage of control characters in status, headers and values for security in Lib/wsgiref/handlers.py Security: python/cpython#144370 Reject leading dashes in webbrowser.open() Security: python/cpython#143930 / 9fdad262-2e0f-11f1-88c7-00a098b42aeb / CVE-2026-4519 Excess Base64 data ignored after padding by default Security: python/cpython#145264 / CVE-2026-3446 Additional security related PRs from upstream HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF Obtained from: python/cpython#148342 Security python/cpython#146212 / CVE-2026-1502 configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to quadratic backtracking Obtained from: python/cpython#148287 Security: python/cpython#146333 (cherry picked from commit 955268b)

) (#148342) gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212) (cherry picked from commit 05ed7ce) Co-authored-by: Seth Larson <seth@python.org> Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

…146212) Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

) (#148343) gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212) (cherry picked from commit 05ed7ce) Co-authored-by: Seth Larson <seth@python.org> Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

) (#148341) gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212) (cherry picked from commit 05ed7ce) Co-authored-by: Seth Larson <seth@python.org> Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

#148351) [3.11] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212) (cherry picked from commit 05ed7ce) Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

#148350) [3.10] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212) (cherry picked from commit 05ed7ce) Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

Add a -flto=full option, which can speed up the port build in terms of wallclock time at the expense of overall more CPU time. Issue a warning that test_ssl will fail from pre-test if DEBUG is enabled. Changelog: https://docs.python.org/release/3.14.4/whatsnew/changelog.html PR: 294324 Which contains these security fixes: pyexpat.c: Unbounded C recursion in conv_content_model causes crash Security: python/cpython#145986 / CVE-2026-4224 Reject control characters in more places in http.cookies.Morsel Security: python/cpython#145599 / CVE-2026-3644 SourcelessFileLoader does not use io.open_code() Security: python/cpython#145506 / CVE-2026-2297 Disallow usage of control characters in status, headers and values for security in Lib/wsgiref/handlers.py Security: python/cpython#144370 Reject leading dashes in webbrowser.open() Security: python/cpython#143930 / 9fdad262-2e0f-11f1-88c7-00a098b42aeb / CVE-2026-4519 Excess Base64 data ignored after padding by default Security: python/cpython#145264 / CVE-2026-3446 Additional security related PRs from upstream HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF Obtained from: python/cpython#148342 Security python/cpython#146212 / CVE-2026-1502 configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to quadratic backtracking Obtained from: python/cpython#148287 Security: python/cpython#146333

pythongh-146211: Reject CR/LF in HTTP tunnel request headers

1703bdd

sethmlarson requested a review from serhiy-storchaka March 20, 2026 14:31

sethmlarson added the type-security A security issue label Mar 20, 2026

bedevere-app Bot added the awaiting review label Mar 20, 2026

bedevere-app Bot mentioned this pull request Mar 20, 2026

HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF #146211

Closed

Merge branch 'main' into http-client-proxy-tunnel

fc69621

sethmlarson requested a review from ambv March 25, 2026 22:19

illia-v reviewed Apr 3, 2026

View reviewed changes

Comment thread Lib/http/client.py Outdated

sethmlarson and others added 4 commits April 10, 2026 13:54

Update Lib/http/client.py

277163d

Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

Merge branch 'main' into http-client-proxy-tunnel

0d50065

Escape single quote

b7ea6ae

Update test_httplib.py

0176ee7

sethmlarson merged commit 05ed7ce into python:main Apr 10, 2026
54 checks passed

sethmlarson deleted the http-client-proxy-tunnel branch April 10, 2026 15:21

bedevere-app Bot removed the awaiting review label Apr 10, 2026

sethmlarson added needs backport to 3.10 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels Apr 10, 2026

miss-islington-app Bot assigned sethmlarson Apr 10, 2026

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Apr 10, 2026

bedevere-app Bot removed the needs backport to 3.13 only security fixes label Apr 10, 2026

bedevere-app Bot removed the needs backport to 3.10 label Apr 10, 2026

bedevere-app Bot removed the needs backport to 3.11 only security fixes label Apr 10, 2026

UTsweetyfish mentioned this pull request Apr 13, 2026

python3.12: CVE-2026-1502 deepin-community/sig-deepin-security#321

Closed

This comment was marked as spam.

Sign in to view

ljfp pushed a commit to ljfp/cpython that referenced this pull request Apr 25, 2026

pythongh-146211: Reject CR/LF in HTTP tunnel request headers (python#…

2e5fe78

…146212) Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

vulgraph mentioned this pull request Apr 30, 2026

3.10: CVE-2026-1502 fix for CR/LF in HTTP tunnel request headers appears unbackported #149197

Closed

ZeroIntensity mentioned this pull request Oct 9, 2026

http.client.HTTPSConnection._tunnel raises AttributeError: 'NoneType' object has no attribute 'encode' when header value is None #159044

Open

bielpieroli mentioned this pull request Oct 12, 2026

gh-159044: Restore string conversion for HTTP tunnel header values #159216

Merged

Conversation

sethmlarson commented Mar 20, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sethmlarson commented Mar 20, 2026

Uh oh!

illia-v left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sethmlarson commented Apr 10, 2026

Uh oh!

Uh oh!

miss-islington-app Bot commented Apr 10, 2026

Uh oh!

miss-islington-app Bot commented Apr 10, 2026

Uh oh!

miss-islington-app Bot commented Apr 10, 2026

Uh oh!

miss-islington-app Bot commented Apr 10, 2026

Uh oh!

miss-islington-app Bot commented Apr 10, 2026

Uh oh!

miss-islington-app Bot commented Apr 10, 2026

Uh oh!

bedevere-app Bot commented Apr 10, 2026

Uh oh!

miss-islington-app Bot commented Apr 10, 2026

Uh oh!

bedevere-app Bot commented Apr 10, 2026

Uh oh!

bedevere-app Bot commented Apr 10, 2026

Uh oh!

bedevere-app Bot commented Apr 10, 2026

Uh oh!

This comment was marked as spam.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sethmlarson commented Mar 20, 2026 •

edited by bedevere-app Bot

Loading