Vulnerability in Python Software Foundation Cpython
CVE-2026-0865
User-controlled header names and values containing newlines can allow injecting HTTP headers.
EPSS: 0.005 (37.7th percentile) — read the EPSS interpretation.
Affected products
- Python Software Foundation Cpython — versions 0, 3.11.0, 3.12.0
Weakness classification (CWE)
References
- cna@python.org (patch)
- cna@python.org (issue-tracking)
- cna@python.org (vendor-advisory)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)