GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-143916: Reject control characters in wsgiref.headers.Headers by sethmlarson · Pull Request #143917 · python/cpython

Conversation

@sethmlarson

@sethmlarson sethmlarson commented Jan 16, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor
  • Issue: Reject control characters in wsgiref.headers.Headers #143916

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
sethmlarson added 2 commits January 16, 2026 10:54
@sethmlarson
Add 'test.support' fixture for C0 control characters
e7f180b
@sethmlarson
pythongh-143916: Reject control characters in wsgiref.headers.Headers
b8fcac2
@sethmlarson sethmlarson added type-security A security issue needs backport to 3.10 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels Jan 16, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Jan 16, 2026
Reject control characters in wsgiref.headers.Headers #143916
Closed
@sethmlarson
sethmlarson requested a review from gpshead January 16, 2026 17:08
@bedevere-app bedevere-app Bot added the awaiting review label Jan 16, 2026
webknjaz
webknjaz reviewed Jan 16, 2026
View reviewed changes
Comment thread Lib/test/test_wsgiref.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
gpshead
gpshead approved these changes Jan 17, 2026
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Jan 17, 2026
@gpshead
gpshead merged commit f7fceed into python:main Jan 17, 2026
65 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Jan 17, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Jan 17, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jan 17, 2026
@sethmlarson @miss-islington
pythongh-143916: Reject control characters in wsgiref.headers.Headers (…
bc274eb 
…pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers
(cherry picked from commit f7fceed)

Co-authored-by: Seth Michael Larson <[email protected]>
@miss-islington-app

miss-islington-app Bot commented Jan 17, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f7fceed79ca1bceae8dbe5ba5bc8928564da7211 3.13
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned gpshead Jan 17, 2026
@miss-islington-app

miss-islington-app Bot commented Jan 17, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f7fceed79ca1bceae8dbe5ba5bc8928564da7211 3.12
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Jan 17, 2026

Copy link
Copy Markdown

GH-143972 is a backport of this pull request to the 3.14 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Jan 17, 2026
@miss-islington-app

miss-islington-app Bot commented Jan 17, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f7fceed79ca1bceae8dbe5ba5bc8928564da7211 3.11
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Jan 17, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f7fceed79ca1bceae8dbe5ba5bc8928564da7211 3.10
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
gpshead pushed a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
@sethmlarson @gpshead
pythongh-143916: Reject control characters in wsgiref.headers.Headers (…
dd05b44 
…pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
@gpshead

gpshead commented Jan 17, 2026

Copy link
Copy Markdown
Member

#143973 for 3.13
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Jan 17, 2026

Copy link
Copy Markdown

GH-143973 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Jan 17, 2026
@gpshead gpshead mentioned this pull request Jan 17, 2026
[3.12] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917) (GH-143973) #143974
Merged
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
@gpshead @sethmlarson
[3.12] pythongh-143916: Reject control characters in wsgiref.headers.…
03a7342 
…Headers (pythonGH-143917) (pythonGH-143973)

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
@gpshead @sethmlarson
[3.11] pythongh-143916: Reject control characters in wsgiref.headers.…
2c84d78 
…Headers (pythonGH-143917) (pythonGH-143973)

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
@gpshead gpshead mentioned this pull request Jan 17, 2026
[3.11] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917) (GH-143973) #143975
Merged
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
@gpshead @sethmlarson
[3.10] pythongh-143916: Reject control characters in wsgiref.headers.…
123bfbb 
…Headers (pythonGH-143917) (pythonGH-143973)

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Seth Michael Larson <[email protected]>
@gpshead gpshead mentioned this pull request Jan 17, 2026
[3.10] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917) (GH-143973) #143976
Merged
@bedevere-bot

bedevere-bot commented Jan 17, 2026

Copy link
Copy Markdown

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot ARM64 macOS 3.13 (tier-2) has failed when building commit 22e4d55.

What do you need to do:

  1. Don't panic.
  2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
  3. Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1404/builds/1475) and take a look at the build logs.
  4. Check if the failure is related to this commit (22e4d55) or if it is a false positive.
  5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1404/builds/1475

Failed tests:

  • test_urllib2net

Summary of the results of the build (if available):

==

Click to see traceback logs 
remote: Enumerating objects: 14, done.        
remote: Counting objects:   8% (1/12)        
remote: Counting objects:  16% (2/12)        
remote: Counting objects:  25% (3/12)        
remote: Counting objects:  33% (4/12)        
remote: Counting objects:  41% (5/12)        
remote: Counting objects:  50% (6/12)        
remote: Counting objects:  58% (7/12)        
remote: Counting objects:  66% (8/12)        
remote: Counting objects:  75% (9/12)        
remote: Counting objects:  83% (10/12)        
remote: Counting objects:  91% (11/12)        
remote: Counting objects: 100% (12/12)        
remote: Counting objects: 100% (12/12), done.        
remote: Total 14 (delta 11), reused 11 (delta 11), pack-reused 2 (from 1)        
From https://github.com/python/cpython
 * branch                    3.13       -> FETCH_HEAD
Note: switching to '22e4d55285cee52bc4dbe061324e5f30bd4dee58'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at 22e4d55285c [3.13] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917) (#143973)
Switched to and reset branch '3.13'

./Modules/selectmodule.c:1988:35: warning: cast from 'PyObject *(*)(PyObject *)' (aka 'struct _object *(*)(struct _object *)') to 'PyCFunction' (aka 'struct _object *(*)(struct _object *, struct _object *)') converts to incompatible function type [-Wcast-function-type-mismatch]
 1988 |     "kqueue_tracking_after_fork", (PyCFunction)kqueue_tracking_after_fork,
      |                                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.

make: *** [buildbottest] Error 2
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Yhg1s pushed a commit that referenced this pull request Jan 19, 2026
@gpshead @sethmlarson
[3.12] gh-143916: Reject control characters in wsgiref.headers.Headers (
4802b96 
GH-143917) (GH-143973) (#143974)

* Add 'test.support' fixture for C0 control characters
* gh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Seth Michael Larson <[email protected]>
sethmlarson added a commit that referenced this pull request Jan 20, 2026
@gpshead @sethmlarson
[3.10] gh-143916: Reject control characters in wsgiref.headers.Headers
2f84024 
gh-143916: Reject control characters in wsgiref.headers.Headers  (GH-143917)

* Add 'test.support' fixture for C0 control characters
* gh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Seth Michael Larson <[email protected]>
sethmlarson added a commit that referenced this pull request Jan 20, 2026
@gpshead @sethmlarson
[3.11] gh-143916: Reject control characters in wsgiref.headers.Headers
e4846a9 
gh-143916: Reject control characters in wsgiref.headers.Headers  (GH-143917)

* Add 'test.support' fixture for C0 control characters
* gh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Seth Michael Larson <[email protected]>
@sethmlarson sethmlarson mentioned this pull request Jan 21, 2026
gh-143916: Allow HTAB in wsgiref header values #144118
Merged
frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request Jan 30, 2026
@gpshead @sethmlarson @frenzymadness
00473: CVE-2026-0865
c8f6d57 
pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Seth Michael Larson <[email protected]>
@benediktjohannes benediktjohannes mentioned this pull request Jan 31, 2026
gh-144370: Disallow usage of control characters in status in Lib/wsgiref/handlers.py for security #144371
Merged
frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request Feb 2, 2026
@gpshead @sethmlarson @frenzymadness
00473: CVE-2026-0865
881d22e 
pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit 2f84024)

Co-authored-by: Seth Michael Larson <[email protected]>
hroncok pushed a commit to fedora-python/cpython that referenced this pull request Feb 3, 2026
@gpshead @sethmlarson @hroncok
00473: CVE-2026-0865
b6b7f6f 
pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit 2f84024)

Co-authored-by: Seth Michael Larson <[email protected]>
hrnciar pushed a commit to fedora-python/cpython that referenced this pull request Feb 6, 2026
@sethmlarson @hrnciar
00473: CVE-2026-0865
37c1f47 
 pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers
hrnciar pushed a commit to fedora-python/cpython that referenced this pull request Feb 6, 2026
@sethmlarson @hrnciar
00473: CVE-2026-0865
37a1fbe 
 pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers
hrnciar pushed a commit to fedora-python/cpython that referenced this pull request Feb 9, 2026
@sethmlarson @hrnciar
00473: CVE-2026-0865
da23884 
 pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers
hrnciar pushed a commit to fedora-python/cpython that referenced this pull request Feb 9, 2026
@sethmlarson @hrnciar
00473: CVE-2026-0865
88fb47f 
 pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers
hrnciar pushed a commit to fedora-python/cpython that referenced this pull request Feb 9, 2026
@sethmlarson @hrnciar
00473: CVE-2026-0865
bbf25b0 
 pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers
@sethmlarson
sethmlarson deleted the reject-control-characters-wsgiref branch February 12, 2026 20:41
thunder-coding pushed a commit to thunder-coding/cpython that referenced this pull request Feb 15, 2026
@sethmlarson @thunder-coding
pythongh-143916: Reject control characters in wsgiref.headers.Headers (
d5091ae 
pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers
@hugovk hugovk removed needs backport to 3.12 only security fixes needs backport to 3.11 only security fixes needs backport to 3.10 labels Feb 27, 2026
@sethmlarson sethmlarson mentioned this pull request Mar 10, 2026
Security hole in wsgiref.headers.Headers #55880
Closed
@picnixz picnixz mentioned this pull request Mar 10, 2026
bpo-11671: add header validation from http.client to wsgiref.headers.Headers #15299
Closed
hroncok pushed a commit to fedora-python/cpython that referenced this pull request Mar 26, 2026
@sethmlarson @hroncok
00473: CVE-2026-0865
c4e439f 
 pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers
ahi647958-spec

This comment was marked as spam.

Sign in to view

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request Oct 28, 2026
@gpshead @sethmlarson @icanhasmath
[3.10] pythongh-143916: Reject control characters in wsgiref.headers.…
9ee8825 
…Headers

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Seth Michael Larson <[email protected]>
(cherry picked from commit 2f84024)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@webknjaz webknjaz webknjaz left review comments
@picnixz picnixz picnixz left review comments
@gpshead gpshead gpshead approved these changes
+1 more reviewer
@ahi647958-spec ahi647958-spec ahi647958-spec left review comments
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

7 participants

@sethmlarson @gpshead @bedevere-bot @webknjaz @picnixz @ahi647958-spec @hugovk
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.