HTTP client proxy tunnel headers not validated for CR/LF

Versions reported by the vendor

Affected version ranges reported by the assigning authority (PSF). Independent of NVD's CPE analysis and usually ahead of it.

• Python Software Foundation CPython

  • before 3.10.21affected · python
  • 3.11.0 and later · before 3.11.16affected · python
  • 3.12.0 and later · before 3.12.14affected · python
  • 3.13.0 and later · before 3.13.14affected · python
  • 3.14.0a1 and later · before 3.14.5rc1affected · python
  • 3.15.0a1 and later · before 3.15.0b1affected · python

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2025-4517Arbitrary writes via tarfile realpath overflow
  37Monitor
• CVE-2026-19445Use-after-free of a server-side SSLContext when sni_callback switches contexts
  36Monitor
• CVE-2026-6100Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
  36Monitor
• CVE-2026-3298Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
  35Monitor
• CVE-2024-12254Unbounded memory buffering in SelectorSocketTransport.writelines()
  35Monitor
• CVE-2024-8088Infinite loop when iterating over zip archive entry names from zipfile.Path
  34Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.