[3.10] gh-143916: Reject control characters in wsgiref.headers.Headers
authorGregory P. Smith <68491+gpshead@users.noreply.github.com>
Tue, 20 Jan 2026 22:51:43 +0000 (14:51 -0800)
committerArnaud Rebillout <arnaudr@debian.org>
Tue, 14 Apr 2026 04:38:32 +0000 (11:38 +0700)
commitd90762a9cb99e8346ee58d0166cba387becb7602
tree5a8de5dd75fd769bc8700f3695edf09b6722729c
parentf525b54411c1bfbf0f5a2df21c3585a3149263ec
[3.10] gh-143916: Reject control characters in wsgiref.headers.Headers

gh-143916: Reject control characters in wsgiref.headers.Headers  (GH-143917)

* Add 'test.support' fixture for C0 control characters
* gh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed79ca1bceae8dbe5ba5bc8928564da7211)
(cherry picked from commit 22e4d55285cee52bc4dbe061324e5f30bd4dee58)

Co-authored-by: Seth Michael Larson <seth@python.org>
Origin: backport, https://github.com/python/cpython/commit/2f840249550e082dc351743f474ba56da10478d2

Gbp-Pq: Name CVE-2026-0865.patch
Lib/test/support/__init__.py
Lib/test/test_wsgiref.py
Lib/wsgiref/headers.py
Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst [new file with mode: 0644]