Jan 17, 2026 · Jan 17, 2026
diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
 return_linked_to_musl
 _linked_to_musl=tuple(map(int,version.split('.')))
 return_linked_to_musl


 defcontrol_characters_c0()->list[str]:
 """Returns a list of C0 control characters as strings.
    C0 control characters defined as the byte range 0x00-0x1F, and 0x7F.
    """
 return [chr(c)forcinrange(0x00,0x20)]+ ["\x7F"]
diff --git a/Lib/test/test_wsgiref.py b/Lib/test/test_wsgiref.py
 fromunittestimportmock
 fromtestimportsupport
 fromtest.supportimportsocket_helper
 fromtest.supportimportsocket_helper,control_characters_c0
 fromtest.test_httpserversimportNoLogRequestHandler
 fromunittestimportTestCase
 fromwsgiref.utilimportsetup_testing_defaults
 '\r\n'
        )

 deftestRaisesControlCharacters(self):
 headers=Headers()
 forc0incontrol_characters_c0():
 self.assertRaises(ValueError,headers.__setitem__,f"key{c0}","val")
 self.assertRaises(ValueError,headers.__setitem__,"key",f"val{c0}")
 self.assertRaises(ValueError,headers.add_header,f"key{c0}","val",param="param")
 self.assertRaises(ValueError,headers.add_header,"key",f"val{c0}",param="param")
 self.assertRaises(ValueError,headers.add_header,"key","val",param=f"param{c0}")


 classErrorHandler(BaseCGIHandler):
 """Simple handler subclass for testing BaseHandler"""

diff --git a/Lib/wsgiref/headers.py b/Lib/wsgiref/headers.py
 # existence of which force quoting of the parameter value.
 importre
 tspecials=re.compile(r'[ \(\)<>@,;:\\"/\[\]\?=]')
 _control_chars_re=re.compile(r'[\x00-\x1F\x7F]')

 def_formatparam(param,value=None,quote=1):
 """Convenience function to format and return a key=value pair.
 def_convert_string_type(self,value):
 """Convert/check value type."""
 iftype(value)isstr:
 if_control_chars_re.search(value):
 raiseValueError("Control characters not allowed in headers")
 returnvalue
 raiseAssertionError("Header names/values must be"
 " of type str (got {0})".format(repr(value)))
diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst
 Reject C0 control characters within wsgiref.headers.Headers fields, values,
 and parameters.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3216,3 +3216,10 @@ def linked_to_musl():
		return_linked_to_musl
		_linked_to_musl=tuple(map(int,version.split('.')))
		return_linked_to_musl


		defcontrol_characters_c0()->list[str]:
		"""Returns a list of C0 control characters as strings.
		C0 control characters defined as the byte range 0x00-0x1F, and 0x7F.
		"""
		return [chr(c)forcinrange(0x00,0x20)]+ ["\x7F"]
Original file line number	Diff line number	Diff line change
		@@ -1,6 +1,6 @@
		fromunittestimportmock
		fromtestimportsupport
		fromtest.supportimportsocket_helper
		fromtest.supportimportsocket_helper,control_characters_c0
		fromtest.test_httpserversimportNoLogRequestHandler
		fromunittestimportTestCase
		fromwsgiref.utilimportsetup_testing_defaults
Expand DownExpand Up		@@ -503,6 +503,16 @@ def testExtras(self):
		'\r\n'
		)

		deftestRaisesControlCharacters(self):
		headers=Headers()
		forc0incontrol_characters_c0():
		self.assertRaises(ValueError,headers.__setitem__,f"key{c0}","val")
		self.assertRaises(ValueError,headers.__setitem__,"key",f"val{c0}")
		self.assertRaises(ValueError,headers.add_header,f"key{c0}","val",param="param")
		self.assertRaises(ValueError,headers.add_header,"key",f"val{c0}",param="param")
		self.assertRaises(ValueError,headers.add_header,"key","val",param=f"param{c0}")


		classErrorHandler(BaseCGIHandler):
		"""Simple handler subclass for testing BaseHandler"""

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -9,6 +9,7 @@
		# existence of which force quoting of the parameter value.
		importre
		tspecials=re.compile(r'[ \(\)<>@,;:\\"/\[\]\?=]')
		_control_chars_re=re.compile(r'[\x00-\x1F\x7F]')

		def_formatparam(param,value=None,quote=1):
		"""Convenience function to format and return a key=value pair.
Expand DownExpand Up		@@ -41,6 +42,8 @@ def __init__(self, headers=None):
		def_convert_string_type(self,value):
		"""Convert/check value type."""
		iftype(value)isstr:
		if_control_chars_re.search(value):
		raiseValueError("Control characters not allowed in headers")
		returnvalue
		raiseAssertionError("Header names/values must be"
		" of type str (got {0})".format(repr(value)))
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Reject C0 control characters within wsgiref.headers.Headers fields, values,
		and parameters.