Description

sethmlarson

opened on Jan 16, 2026

Issue body actions

Linked PRs

• gh-143916: Reject control characters in wsgiref.headers.Headers  #143917
• [3.14] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917) #143972
• [3.13] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917) #143973
• [3.12] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917) (GH-143973) #143974
• [3.11] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917) (GH-143973) #143975
• [3.10] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917) (GH-143973) #143976
• gh-143916: Allow HTAB in wsgiref header values #144118
• [3.14] gh-143916: Allow HTAB in wsgiref header values #144761
• [3.13] gh-143916: Allow HTAB in wsgiref header values #144762
• [3.11] gh-143916: Allow HTAB in wsgiref header values #145139
• [3.10] gh-143916: Allow HTAB in wsgiref header values #145140
• [3.12] gh-143916: Allow HTAB in wsgiref header values #145141

Activity

1. sethmlarson

   added a commit that references this issue on Jan 16, 2026

   pythongh-143916: Reject control characters in wsgiref.headers.Headers

   b8fcac2
2. sethmlarson

   changed the title [-]Reject control characters in wsgiref[/-] [+]Reject control characters in wsgiref.headers.Headers[/+] on Jan 16, 2026
3. sethmlarson

   added

   type-securityA security issueA security issue

   on Jan 16, 2026
4. StanFromIreland

   added

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on Jan 16, 2026
5. gpshead

   added a commit that references this issue on Jan 17, 2026

   gh-143916: Reject control characters in wsgiref.headers.Headers (GH-…

   f7fceed
6. miss-islington

   added a commit that references this issue on Jan 17, 2026

   pythongh-143916: Reject control characters in wsgiref.headers.Headers (…

   bc274eb
7. gpshead

   added 6 commits that reference this issue on Jan 17, 2026

   pythongh-143916: Reject control characters in wsgiref.headers.Headers (…

   dd05b44

   [3.14] gh-143916: Reject control characters in wsgiref.headers.Headers (

   23e3c0a

   [3.13] gh-143916: Reject control characters in wsgiref.headers.Headers (

   22e4d55

   [3.12] pythongh-143916: Reject control characters in wsgiref.headers.…

   03a7342

   [3.11] pythongh-143916: Reject control characters in wsgiref.headers.…

   2c84d78

   [3.10] pythongh-143916: Reject control characters in wsgiref.headers.…

   123bfbb
8. Yhg1s

   added a commit that references this issue on Jan 19, 2026

   [3.12] gh-143916: Reject control characters in wsgiref.headers.Headers (

   4802b96
9. sethmlarson

   added 2 commits that reference this issue on Jan 20, 2026

   [3.10] gh-143916: Reject control characters in wsgiref.headers.Headers

   2f84024

   [3.11] gh-143916: Reject control characters in wsgiref.headers.Headers

   e4846a9
10. 45 remaining items
11. pablogsal

    added 2 commits that reference this issue on Mar 2, 2026

    [3.11] gh-143916: Allow HTAB in wsgiref header values (#145139)

    286e3ac

    [3.10] gh-143916: Allow HTAB in wsgiref header values (#145140)

    c592227
12. pablogsal

    closed this as completedon Mar 2, 2026
13. github-project-automation

    moved this from Todo to Done in Release and Deferred blockers 🚫on Mar 2, 2026
14. picnixz

    removed

    release-blocker

    3.11only security fixesonly security fixes

    3.10 (EOL)end of lifeend of life

    on Mar 2, 2026
15. hroncok

    added a commit that references this issue on Mar 26, 2026

    00473: CVE-2026-0865

    c4e439f
16. ljfp

    added a commit that references this issue on Apr 25, 2026

    pythongh-143916: Allow HTAB in wsgiref header values

    2343eeb
17. mcepl

    added 2 commits that reference this issue on Sep 18, 2026

    [CVE-2026-0865] Reject control characters in wsgiref.headers.Headers

    711c380

    [CVE-2026-0865] Reject control characters in wsgiref.headers.Headers

    1354609
18. mcepl

    added 2 commits that reference this issue on Oct 1, 2026

    [CVE-2026-0865] Reject control characters in wsgiref.headers.Headers

    cbc2efa

    [CVE-2026-0865] Reject control characters in wsgiref.headers.Headers

    1fe2a6b
19. icanhasmath

    added 2 commits that reference this issue on Oct 28, 2026

    [3.10] pythongh-143916: Reject control characters in wsgiref.headers.…

    9ee8825

    [3.10] pythongh-143916: Allow HTAB in wsgiref header values (python#1…

    32ec6c3

Issue actions