Repository navigation
[security] Disallow usage of control characters in status, headers and values for security in Lib/wsgiref/handlers.py #144370
Description
This issue is opened as public as the primary described CVE is already publicated and this only contains one certain point that has to be changed in code in Python.
In Lib/wsgiref/handlers.py at 260 (def _convert_string_type(self, value, title):) it is necessary to add the same fix as in #143916 requested as well.
Linked PRs
- gh-144370: Disallow usage of control characters in status in Lib/wsgiref/handlers.py for security #144371
- [3.13] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (GH-144371) #145585
- [3.14] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (GH-144371) #145586
- [3.12] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (GH-144371) #145671
- [3.11] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (#144371) #145672
- [3.10] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (#144371) #145673
Activity
benediktjohannes commented on Feb 1, 2026
@picnixz please also reopen the issue (see the explaination in the PR), thanks!
picnixz commented on Feb 1, 2026
In this case please reformulate the title as the other issue. And be sure that this issue is in scope wrt RFCs and PEPs.
gh-144370: Disallow usage of control characters in status in wsgiref.…
pythongh-144370: Disallow usage of control characters in status in ws…
pythongh-144370: Disallow usage of control characters in status in ws…
[3.13] gh-144370: Disallow usage of control characters in status in w…
[3.14] gh-144370: Disallow usage of control characters in status in w…
pythongh-144370: Disallow usage of control characters in status in ws…
lang/python314: security update to 3.14.4
lang/python314: security update to 3.14.4
lang/python314: security update to 3.14.4
lang/python314: security update to 3.14.4
lang/python314: security update to 3.14.4
lang/python314: Security update to 3.14.4
lang/python314: Security update to 3.14.4
pythongh-144370: Disallow usage of control characters in status in ws…
[3.10] gh-144370: Disallow usage of control characters in status in w…
[3.11] gh-144370: Disallow usage of control characters in status in w…
lang/python314: Security update to 3.14.4
lang/python314: Security update to 3.14.4
[3.12] gh-144370: Disallow usage of control characters in status in w…