Vulnerability in Python Software Foundation Cpython

CVE-2026-1502

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

Vulnerability class: CRLF Injection

EPSS: 0.006 (43.5th percentile) — read the EPSS interpretation.

Affected products

Python Software Foundation Cpython — versions 0, 3.13.0, 3.11.0

Weakness classification (CWE)

CWE-93 — CRLF Injection

References