BIT-python-2026-0865: wsgiref.headers.Headers allows header newline injection
Published Jan 20, 2026
·Updated
User-controlled header names and values containing newlines can allow injecting HTTP headers.
Affected Software
1 affected component
Python Software Foundation wsgiref.headers.Headers
Event History
Jan 20, 2026
CVE Published
via OSV·09:26 PM
Data Sourced
via OSV·09:26 PM
DescriptionSeverityWeakness