5.9

CVE-2026-0865

wsgiref.headers.Headers allows header newline injection

User-controlled header names and values containing newlines can allow injecting HTTP headers.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerPython Software Foundation
≫
Produkt CPython
Default Statusunaffected
Version 0
Version < 3.10.20
Status affected
Version 3.11.0
Version < 3.11.15
Status affected
Version 3.12.0
Version < 3.12.13
Status affected
Version 3.13.0
Version < 3.13.12
Status affected
Version 3.14.0
Version < 3.14.3
Status affected
Version 3.15.0a1
Version < 3.15.0a6
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.365
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cna@python.org 5.9 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

https://github.com/python/cpython/pull/143917
https://github.com/python/cpython/issues/143916
https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/
https://github.com/python/cpython/commit/22e4d55285cee52bc4dbe061324e5f30bd4dee58
https://github.com/python/cpython/commit/23e3c0ae867cca0130e441e776c9955b9027c510
https://github.com/python/cpython/commit/2f840249550e082dc351743f474ba56da10478d2
https://github.com/python/cpython/commit/4802b96a2cde58570c24c13ef3289490980961c5
https://github.com/python/cpython/commit/e4846a93ac07a8ae9aa18203af0dd13d6e7a6995
https://github.com/python/cpython/commit/f7fceed79ca1bceae8dbe5ba5bc8928564da7211
https://github.com/python/cpython/commit/66da7bf6fe7b81e3ecc9c0a25bd47d4616c8d1a6
https://github.com/python/cpython/commit/83ecd18779f286d872f68bfce175651e407d9fff
https://github.com/python/cpython/commit/bfba660085767f8c2d582134e9d511a85eda04cf
https://github.com/python/cpython/commit/286e3ac39984fe85a17f4ab39c64d382137aae5f
https://github.com/python/cpython/commit/8bb044d29310bb05d15086cdaa8bf64867d61a97
https://github.com/python/cpython/commit/c592227ffb48679af9845a45dbb0875d975bb219