{"id":"CVE-2026-1502","title":"CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.","summary":"CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.","severity":"none","cwe":["CWE-93"],"published":"2026-04-10","updated":"2026-06-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-1502","references":[{"url":"https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3e","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8dd","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2ed","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ec","label":"cna@python.org"},{"url":"https://github.com/python/cpython/issues/146211","label":"cna@python.org"},{"url":"https://github.com/python/cpython/pull/146212","label":"cna@python.org"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/","label":"cna@python.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/11/4","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00562,"epssPercentile":0.45317,"ingestedAt":"2026-07-01T03:50:34.559Z","slug":"CVE-2026-1502","body":"## Overview\n\nCR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}