CVE-2026-1502
NoneCVSS
—
EPSS
0.6%
Published
Apr 10, 2026
CISA due date
—
The record
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python310 | 0 | 3.10.20-6.1 |
| openSUSE:Tumbleweed | python311 | 0 | 3.11.15-6.1 |
| openSUSE:Tumbleweed | python312 | 0 | 3.12.13-6.1 |
| openSUSE:Tumbleweed | python313 | 0 | 3.13.13-2.1 |
| openSUSE:Tumbleweed | python314 | 0 | 3.14.6-1.1 |
| openSUSE:Tumbleweed | python315 | 0 | 3.15.0~a8-3.1 |
Related vulnerabilities
- CVE-2026-6019 http.cookies.Morsel.js_output() returns an inline snippet and only escapes " for… Also affects python310
- CVE-2026-4786 Mitgation of CVE-2026-4519 was incomplete. Also affects python310
- CVE-2026-6100 Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`… Also affects python310
- CVE-2026-3446 When calling base64.b64decode() or related functions the decoding process would stop… Also affects python310
- CVE-2026-4519 The webbrowser.open() API would accept leading dashes in the URL which could be handled… Also affects python310
- CVE-2026-3479 DISPUTED: The project has clarified that the documentation was incorrect, and that… Also affects python310
- CVE-2026-4224 When an Expat parser with a registered ElementDeclHandler parses an inline document type… Also affects python310
- CVE-2026-3644 The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was… Also affects python310