Skip to content

[3.14] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)#148342

Merged
hugovk merged 1 commit intopython:3.14from
miss-islington:backport-05ed7ce-3.14
Apr 21, 2026
Merged

[3.14] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212)#148342
hugovk merged 1 commit intopython:3.14from
miss-islington:backport-05ed7ce-3.14

Conversation

@miss-islington
Copy link
Copy Markdown
Contributor

@miss-islington miss-islington commented Apr 10, 2026 •
edited by bedevere-app Bot
Loading

(cherry picked from commit 05ed7ce)

Co-authored-by: Seth Larson seth@python.org
Co-authored-by: Illia Volochii illia.volochii@gmail.com

@sethmlarson @illia-v @miss-islington
pythongh-146211: Reject CR/LF in HTTP tunnel request headers (pythonG…
afdd351 
…H-146212)

(cherry picked from commit 05ed7ce)

Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
@bedevere-app bedevere-app Bot mentioned this pull request Apr 10, 2026
Merged
@bedevere-app bedevere-app Bot mentioned this pull request Apr 10, 2026
Open
mandree added a commit to mandree/freebsd-ports that referenced this pull request Apr 11, 2026
@mandree
lang/python314: security update to 3.14.4
b526f87 
Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.

Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.

Changelog:	https://docs.python.org/release/3.14.4/whatsnew/changelog.html

Which contains these security fixes:

pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:	python/cpython#145986
which is the same as
Security:	CVE-2026-4224

Reject control characters in more places in http.cookies.Morsel
Security:	python/cpython#145599
which is the same as
Security:	CVE-2026-3644

SourcelessFileLoader does not use io.open_code()
Security:	python/cpython#145506
which is the same as
Security:	CVE-2026-2297

[security] Disallow usage of control characters in status, headers and
values for security in Lib/wsgiref/handlers.py
Security:	python/cpython#144370

Reject leading dashes in webbrowser.open()
Security:	python/cpython#143930
which is the same as
Security:	9fdad262-2e0f-11f1-88c7-00a098b42aeb
which is the same as
Security:	CVE-2026-4519

Excess Base64 data ignored after padding by default
Security:	python/cpython#145264
which is the same as
Security:	CVE-2026-3446

Added into PORTREVISION=1: 2 cherry-picks post-3.14.4
HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF
Obtained from:	python/cpython#148342
Security:	python/cpython#146212
Security:	CVE-2026-1502

configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to
quadratic backtracking
Obtained from:	python/cpython#148287
Security:	python/cpython#146333

lang/python314: add FULLLTO and warning
mandree added a commit to mandree/freebsd-ports that referenced this pull request Apr 11, 2026
@mandree
lang/python314: security update to 3.14.4
62a66cb 
Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.

Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.

Changelog:	https://docs.python.org/release/3.14.4/whatsnew/changelog.html

Which contains these security fixes:

pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:	python/cpython#145986
which is the same as
Security:	CVE-2026-4224

Reject control characters in more places in http.cookies.Morsel
Security:	python/cpython#145599
which is the same as
Security:	CVE-2026-3644

SourcelessFileLoader does not use io.open_code()
Security:	python/cpython#145506
which is the same as
Security:	CVE-2026-2297

[security] Disallow usage of control characters in status, headers and
values for security in Lib/wsgiref/handlers.py
Security:	python/cpython#144370

Reject leading dashes in webbrowser.open()
Security:	python/cpython#143930
which is the same as
Security:	9fdad262-2e0f-11f1-88c7-00a098b42aeb
which is the same as
Security:	CVE-2026-4519

Excess Base64 data ignored after padding by default
Security:	python/cpython#145264
which is the same as
Security:	CVE-2026-3446

Added into PORTREVISION=1: 2 cherry-picks post-3.14.4
HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF
Obtained from:	python/cpython#148342
Security:	python/cpython#146212
Security:	CVE-2026-1502

configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to
quadratic backtracking
Obtained from:	python/cpython#148287
Security:	python/cpython#146333

lang/python314: add FULLLTO and warning

(cherry picked from commit b526f87)
freebsd-git pushed a commit to freebsd/freebsd-ports that referenced this pull request Apr 12, 2026
@mandree
lang/python314: Security update to 3.14.4
955268b 
Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.

Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.

Changelog:	https://docs.python.org/release/3.14.4/whatsnew/changelog.html

PR:		294324

Which contains these security fixes:

pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:	python/cpython#145986
		/ CVE-2026-4224

Reject control characters in more places in http.cookies.Morsel
Security:	python/cpython#145599
		/ CVE-2026-3644

SourcelessFileLoader does not use io.open_code()
Security:	python/cpython#145506
		/ CVE-2026-2297

Disallow usage of control characters in status, headers and
values for security in Lib/wsgiref/handlers.py
Security:	python/cpython#144370

Reject leading dashes in webbrowser.open()
Security:	python/cpython#143930
		/ 9fdad262-2e0f-11f1-88c7-00a098b42aeb
		/ CVE-2026-4519

Excess Base64 data ignored after padding by default
Security:	python/cpython#145264
		/ CVE-2026-3446

Additional security related PRs from upstream

HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF
Obtained from:	python/cpython#148342
Security	python/cpython#146212
		/ CVE-2026-1502

configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to
quadratic backtracking
Obtained from:	python/cpython#148287
Security:	python/cpython#146333
freebsd-git pushed a commit to freebsd/freebsd-ports that referenced this pull request Apr 12, 2026
@mandree
lang/python314: Security update to 3.14.4
cb35b3d 
Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.

Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.

Changelog:	https://docs.python.org/release/3.14.4/whatsnew/changelog.html

PR:		294324

Which contains these security fixes:

pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:	python/cpython#145986
		/ CVE-2026-4224

Reject control characters in more places in http.cookies.Morsel
Security:	python/cpython#145599
		/ CVE-2026-3644

SourcelessFileLoader does not use io.open_code()
Security:	python/cpython#145506
		/ CVE-2026-2297

Disallow usage of control characters in status, headers and
values for security in Lib/wsgiref/handlers.py
Security:	python/cpython#144370

Reject leading dashes in webbrowser.open()
Security:	python/cpython#143930
		/ 9fdad262-2e0f-11f1-88c7-00a098b42aeb
		/ CVE-2026-4519

Excess Base64 data ignored after padding by default
Security:	python/cpython#145264
		/ CVE-2026-3446

Additional security related PRs from upstream

HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF
Obtained from:	python/cpython#148342
Security	python/cpython#146212
		/ CVE-2026-1502

configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to
quadratic backtracking
Obtained from:	python/cpython#148287
Security:	python/cpython#146333

(cherry picked from commit 955268b)
@hugovk hugovk merged commit b1cf901 into python:3.14 Apr 21, 2026
57 checks passed
@miss-islington miss-islington deleted the backport-05ed7ce-3.14 branch April 21, 2026 07:49
octo-sts-6 Bot pushed a commit to wolfi-dev/os that referenced this pull request Apr 23, 2026
@brianmcarey
python-3.14: cherry-pick fix for critical CVE-2026-6100 (#72445)
2ba7218 
- **CVE-2026-6100** (Critical, CVSS 9.1) — Use-after-free in `lzma.LZMADecompressor`,
    `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a decompressor instance is re-used
    after MemoryError. Cherry-pick of commit `6a5f79c8` from the 3.14 branch.
    - GHSA: GHSA-pg25-7cx5-cvcm
    - Upstream: python/cpython#148480

- **CVE-2026-1502** (Medium) — CR/LF bytes not rejected in HTTP client proxy tunnel
    headers. Cherry-pick of commit `b1cf9016` from the 3.14 branch.
    - GHSA: GHSA-hjxq-7w9q-2jw6
    - Upstream: python/cpython#148342

- **CVE-2026-4786** (High) — Incomplete mitigation of CVE-2026-4519; `%action`
    substitution bypass of dash-prefix check in `webbrowser`. Cherry-pick of commit
    `d22922c8` from main (3.14 backport PR #148516 is open and mergeable; identical
    file changes verified).
    - GHSA: GHSA-cccx-m78h-m3xw
    - Upstream: python/cpython#148170

Signed-off-by: Brian Carey <brian.carey@chainguard.dev>

Export:  edefd2a320a9e3d0ed5d7eb99a5b6f5c35bcb7fc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@miss-islington @hugovk @sethmlarson
⚡