[3.10] gh-143916: Reject control characters in wsgiref.headers.Headers
authorGregory P. Smith <68491+gpshead@users.noreply.github.com>
Tue, 20 Jan 2026 22:51:43 +0000 (14:51 -0800)
committerArnaud Rebillout <arnaudr@debian.org>
Thu, 14 May 2026 03:00:00 +0000 (10:00 +0700)
commit7920b8e22dd248b39588eea675b50efbeee03ba2
treeca235ae5e62d2c468e4f6131aaa39901f2b13424
parentc38cd4f68457851ed9d656945baf36ac058015d8
[3.10] gh-143916: Reject control characters in wsgiref.headers.Headers

gh-143916: Reject control characters in wsgiref.headers.Headers  (GH-143917)

* Add 'test.support' fixture for C0 control characters
* gh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed79ca1bceae8dbe5ba5bc8928564da7211)
(cherry picked from commit 22e4d55285cee52bc4dbe061324e5f30bd4dee58)

Co-authored-by: Seth Michael Larson <seth@python.org>
Origin: backport, https://github.com/python/cpython/commit/2f840249550e082dc351743f474ba56da10478d2

Gbp-Pq: Name CVE-2026-0865.patch
Lib/test/support/__init__.py
Lib/test/test_wsgiref.py
Lib/wsgiref/headers.py
Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst [new file with mode: 0644]