Jan 17, 2026 · Jan 17, 2026
diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
 except (OSError,subprocess.CalledProcessError):
 returnFalse
 return ('musl'instdout)


 defcontrol_characters_c0()->list[str]:
 """Returns a list of C0 control characters as strings.
    C0 control characters defined as the byte range 0x00-0x1F, and 0x7F.
    """
 return [chr(c)forcinrange(0x00,0x20)]+ ["\x7F"]
diff --git a/Lib/test/test_wsgiref.py b/Lib/test/test_wsgiref.py
 from unittest import mock
 from test import support
 from test.support import socket_helper
 from test.support import socket_helper, control_characters_c0
 from test.test_httpservers import NoLogRequestHandler
 from unittest import TestCase
 from wsgiref.util import setup_testing_defaults
            '\r\n'
        )

    def testRaisesControlCharacters(self):
        headers = Headers()
        for c0 in control_characters_c0():
            self.assertRaises(ValueError, headers.__setitem__, f"key{c0}", "val")
            self.assertRaises(ValueError, headers.__setitem__, "key", f"val{c0}")
            self.assertRaises(ValueError, headers.add_header, f"key{c0}", "val", param="param")
            self.assertRaises(ValueError, headers.add_header, "key", f"val{c0}", param="param")
            self.assertRaises(ValueError, headers.add_header, "key", "val", param=f"param{c0}")


 class ErrorHandler(BaseCGIHandler):
    """Simple handler subclass for testing BaseHandler"""

diff --git a/Lib/wsgiref/headers.py b/Lib/wsgiref/headers.py
 # existence of which force quoting of the parameter value.
 importre
 tspecials=re.compile(r'[ \(\)<>@,;:\\"/\[\]\?=]')
 _control_chars_re=re.compile(r'[\x00-\x1F\x7F]')

 def_formatparam(param,value=None,quote=1):
 """Convenience function to format and return a key=value pair.
 def_convert_string_type(self,value):
 """Convert/check value type."""
 iftype(value)isstr:
 if_control_chars_re.search(value):
 raiseValueError("Control characters not allowed in headers")
 returnvalue
 raiseAssertionError("Header names/values must be"
 " of type str (got {0})".format(repr(value)))
diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst
 Reject C0 control characters within wsgiref.headers.Headers fields, values,
 and parameters.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -2856,3 +2856,10 @@ def linked_to_musl():
		except (OSError,subprocess.CalledProcessError):
		returnFalse
		return ('musl'instdout)


		defcontrol_characters_c0()->list[str]:
		"""Returns a list of C0 control characters as strings.
		C0 control characters defined as the byte range 0x00-0x1F, and 0x7F.
		"""
		return [chr(c)forcinrange(0x00,0x20)]+ ["\x7F"]
Original file line number	Diff line number	Diff line change
		@@ -1,6 +1,6 @@
		from unittest import mock
		from test import support
		from test.support import socket_helper
		from test.support import socket_helper, control_characters_c0
		from test.test_httpservers import NoLogRequestHandler
		from unittest import TestCase
		from wsgiref.util import setup_testing_defaults
Expand DownExpand Up		@@ -503,6 +503,16 @@ def testExtras(self):
		'\r\n'
		)

		def testRaisesControlCharacters(self):
		headers = Headers()
		for c0 in control_characters_c0():
		self.assertRaises(ValueError, headers.__setitem__, f"key{c0}", "val")
		self.assertRaises(ValueError, headers.__setitem__, "key", f"val{c0}")
		self.assertRaises(ValueError, headers.add_header, f"key{c0}", "val", param="param")
		self.assertRaises(ValueError, headers.add_header, "key", f"val{c0}", param="param")
		self.assertRaises(ValueError, headers.add_header, "key", "val", param=f"param{c0}")


		class ErrorHandler(BaseCGIHandler):
		"""Simple handler subclass for testing BaseHandler"""

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -9,6 +9,7 @@
		# existence of which force quoting of the parameter value.
		importre
		tspecials=re.compile(r'[ \(\)<>@,;:\\"/\[\]\?=]')
		_control_chars_re=re.compile(r'[\x00-\x1F\x7F]')

		def_formatparam(param,value=None,quote=1):
		"""Convenience function to format and return a key=value pair.
Expand DownExpand Up		@@ -41,6 +42,8 @@ def __init__(self, headers=None):
		def_convert_string_type(self,value):
		"""Convert/check value type."""
		iftype(value)isstr:
		if_control_chars_re.search(value):
		raiseValueError("Control characters not allowed in headers")
		returnvalue
		raiseAssertionError("Header names/values must be"
		" of type str (got {0})".format(repr(value)))
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Reject C0 control characters within wsgiref.headers.Headers fields, values,
		and parameters.