[3.11] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (#144371)#145672

Open

vstinner wants to merge 1 commit intopython:3.11from

vstinner:wsgiref311

Open

[3.11] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (#144371)#145672
vstinner wants to merge 1 commit intopython:3.11from
vstinner:wsgiref311

Conversation

Copy link

Member

vstinner commentedMar 9, 2026•
edited by bedevere-appbot
Loading

Disallow usage of control characters in status in wsgiref.handlers to prevent HTTP header injections.

(cherry picked from commitd931725)

Issue:[security] Disallow usage of control characters in status, headers and values for security in Lib/wsgiref/handlers.py #144370

pythongh-144370: Disallow usage of control characters in status in ws…

05e14b3

…giref.handlers for security (python#144371)Disallow usage of control characters in status in wsgiref.handlersto prevent HTTP header injections.Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>Co-authored-by: Victor Stinner <vstinner@python.org>(cherry picked from commitd931725)