Skip to content

[3.13] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)#148343

Open
miss-islington wants to merge 1 commit intopython:3.13from
miss-islington:backport-05ed7ce-3.13
Open

[3.13] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)#148343
miss-islington wants to merge 1 commit intopython:3.13from
miss-islington:backport-05ed7ce-3.13

Conversation

@miss-islington
Copy link
Copy Markdown
Contributor

@miss-islington miss-islington commented Apr 10, 2026 •
edited by bedevere-app bot
Loading

(cherry picked from commit 05ed7ce)

Co-authored-by: Seth Larson seth@python.org
Co-authored-by: Illia Volochii illia.volochii@gmail.com

@sethmlarson @illia-v @miss-islington
pythongh-146211: Reject CR/LF in HTTP tunnel request headers (pythonG…
c3f2505 
…H-146212)

(cherry picked from commit 05ed7ce)

Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
@bedevere-app bedevere-app bot added the type-security A security issue label Apr 10, 2026
@bedevere-app bedevere-app bot mentioned this pull request Apr 10, 2026
Merged
@bedevere-app bedevere-app bot mentioned this pull request Apr 10, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

awaiting review release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Todo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@miss-islington @sethmlarson