PT-2026-32007 · Python · Cpython

Senseicat + 1 · Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-1502

Mitre

CVSS v4.0

5.7

Medium

AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

Fix

Related Identifiers

CVE-2026-1502

Affected Products

Cpython

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-1502 · Security Note
• https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69 · Patch
• https://github.com/python/cpython/pull/146212 · Patch
• https://mail.python.org/archives/list/[e-mail]/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3 · Vendor Advisory
• https://github.com/python/cpython/issues/146211 · Note