Repository navigation
Document CRLF handling for http.server #142533
Description
Bug report
Bug description:
Vulnerability Description
The send_header method in Lib/http/server.py writes headers directly to the output stream without checking for line breaks. When user-controlled input is passed to send_header, an attacker can inject CRLF sequences (\r\n) to terminate the current header and inject new headers or manipulate the response.
Vulnerable Code:
def send_header(self, keyword, value):
"""Send a MIME header to the headers buffer."""
if self.request_version != 'HTTP/0.9':
if not hasattr(self, '_headers_buffer'):
self._headers_buffer = []
self._headers_buffer.append(
("%s: %s\r\n" % (keyword, value)).encode('latin-1', 'strict'))
# No validation for \r or \n characters!Attack Scenarios
Scenario 1: Set-Cookie Injection (Session Fixation)
Vulnerable Application:
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import parse_qs, urlparse
class VulnerableHandler(BaseHTTPRequestHandler):
def do_GET(self):
query = parse_qs(urlparse(self.path).query)
custom_val = query.get('val', [''])[0]
self.send_response(200)
# VULNERABLE: Direct injection into header
self.send_header('X-Custom', custom_val)
self.end_headers()
self.wfile.write(b"Hello World")Attack URL:
http://localhost:8000/?val=test%0d%0aSet-Cookie:%20pwned=true
Result:
HTTP/1.0 200 OK
Server: BaseHTTP/0.6 Python/3.x
Date: ...
X-Custom: test
Set-Cookie: pwned=trueImpact: Attacker can inject session cookies, leading to session fixation attacks.
Scenario 2: Location Header Injection (Malicious Redirect)
Attack URL:
http://localhost:8000/?val=test%0d%0ALocation:%20http://evil.com/
Result:
HTTP/1.0 200 OK
Server: BaseHTTP/0.6 Python/3.x
Date: ...
X-Custom: test
Location: http://evil.com/Impact:
- Users are redirected to malicious websites
- Phishing attacks
- Open redirect vulnerabilities
- Cache poisoning (if cached responses include the injected Location header)
Verified Test Results:
✓ LOCATION HEADER INJECTION CONFIRMED!
Injected Location: http://evil.com/
✓ MALICIOUS REDIRECT CONFIRMED!
Browser would redirect to: http://evil.com/
✓ MALICIOUS REDIRECT SUCCESSFUL!
Attack Vector
- Type: Remote
- Prerequisites:
- Application uses
http.server.BaseHTTPRequestHandler - User input is reflected in HTTP headers via
send_header() - Common patterns: query parameters, user-agent reflection, custom headers
- Application uses
- Complexity: Low - Simple URL manipulation
- Authentication: Not required
Impact
- Session Fixation: Inject
Set-Cookieheaders to control user sessions - Malicious Redirects: Inject
Locationheaders to redirect users to attacker-controlled sites - Cache Poisoning: Inject headers that affect cached responses
- Cross-Site Scripting (XSS): Inject headers that enable XSS attacks
- Web Cache Deception: Manipulate cache behavior via injected headers
CPython versions tested on:
CPython main branch
Operating systems tested on:
macOS
Linked PRs
- gh-142533: Prevent CRLF injection in HTTP headers #142605
- gh-142533: Document CRLF injection vulnerability in http.server and wsgiref modules #143395
- [3.14] gh-142533: Document CRLF injection vulnerabilities in http.server doc (GH-143395) #148020
- [3.13] gh-142533: Document CRLF injection vulnerabilities in http.server doc (GH-143395) #148021
Activity
pythongh-142533: Validate CRLF in send_response_only and add test
tadejmagajna commentedon Dec 12, 2025
@vadmium thanks for the suggestion about
send_response_only. It’s now covered in the latest commit.The other cases from the linked issues are already handled in the PR by raising an exception, matching the approach you outlined. A review of the PR when you have time would be much appreciated.
tadejmagajna commentedon Dec 21, 2025
@serhiy-storchaka, since you contributed to both
http.serverandwsgirefin the past, I was wondering if you might have the bandwidth to review this fix for the mentioned vulnerability.serhiy-storchaka commentedon Dec 22, 2025
http.server does not perform encoding (using QP or Base64) and line wrapping. Therefore, it is implied that the user is responsible for this -- it must pass an already encoded string, which can contain CRLF if the long string was folded. Isn't it?
pythongh-142533: Apply PR feedback about redundant code changes
pythongh-142533: Document CRLF injection vulnerability in http.server…
[-]CRLF Injection in http.server[/-][+]Document CRLF handling for `http.server`[/+]pythongh-142533: Remove reduntant NEWS entry
pythongh-142533: Ensure CRLF is mentioned in the security considerati…
pythongh-142533: Added label and spacing
aydinnyunus commentedon Feb 4, 2026
Hi team, I think document is not updated yet. Is there any deadline so I can close the issue 🙏
picnixz commentedon Feb 4, 2026
Do not close the issue, maintainers will take care of it when needed (in particular because there might have backports). I haven't time to read through it but I will try to do so this week-end (my daily job takes my time).
EDIT: actually I already approved the PR. Victor was waiting for someone else if needed. I'll merge it this week-end then.
Merge branch 'main' into pythongh-142533-document-server-header-vulne…
pythongh-142533: Remove vulnerability warnings from wsgiref module do…
pythongh-142533: Document CRLF vulnerability also for send_response_only
gh-142533: Document CRLF injection vulnerabilities in http.server doc (…
pythongh-142533: Document CRLF injection vulnerabilities in http.serv…
pythongh-142533: Document CRLF injection vulnerabilities in http.serv…
[3.14] gh-142533: Document CRLF injection vulnerabilities in http.ser…
[3.13] gh-142533: Document CRLF injection vulnerabilities in http.ser…
pythongh-142533: Document CRLF injection vulnerabilities in http.serv…