Vulnerability/
BIT-python-2026-1502

BIT-python-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF

Published Apr 10, 2026

Updated

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

Affected Software

1 affected component

Go Project net/http

Event History

Apr 10, 2026

CVE Published

via OSV·05:54 PM

Data Sourced

via OSV·05:54 PM

DescriptionSeverity

Frequently Asked Questions

What attacker access and conditions are indicated by the severity vector?

The vector indicates network reachability and low attack complexity, but also requires high privileges and user interaction. It also marks attack requirements as present.

What security impact is indicated?

The vector indicates a high integrity impact, with no confidentiality or availability impact. It does not indicate impacts on a subsequent system.

Are affected versions, fixed versions, or mitigations identified?

The provided data does not identify affected or fixed versions, nor does it provide a mitigation or workaround.

CVSS Score

5.7Medium

Medium Severity

AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Security Metrics

Risk Score30

Severitymedium(5.7)

Timeline

PublishedApr 10, 2026

Updated

References

Tags

collector/osv-vulnerabilitysource/OSValias/BIT-libpython-2026-1502alias/BIT-python-2026-1502alias/BIT-python-min-2026-1502alias/PSF-2026-15anchor-related/ALSA-2026:10950anchor-related/ALSA-2026:19019anchor-related/ALSA-2026:19064anchor-related/ALSA-2026:19176anchor-related/ALSA-2026:19177anchor-related/SUSE-SU-2026:1715-1anchor-related/SUSE-SU-2026:1818-1anchor-related/SUSE-SU-2026:1937-1anchor-related/SUSE-SU-2026:1947-1anchor-related/SUSE-SU-2026:2055-1anchor-related/SUSE-SU-2026:22959-1anchor-related/SUSE-SU-2026:23191-1anchor-related/SUSE-SU-2026:23212-1anchor-related/SUSE-SU-2026:23743-1anchor-related/SUSE-SU-2026:2464-1anchor-related/SUSE-SU-2026:3104-1anchor-related/SUSE-SU-2026:3132-1anchor-related/SUSE-SU-2026:3855-1anchor-related/SUSE-SU-2026:4534-1anchor-related/SUSE-SU-2026:4580-1anchor-related/SUSE-SU-2026:4581-1anchor-related/SUSE-SU-2026:4582-1anchor-related/SUSE-SU-2026:4583-1anchor-related/SUSE-SU-2026:4584-1anchor-related/SUSE-SU-2026:4585-1anchor-related/openSUSE-SU-2026:10647-1anchor-related/openSUSE-SU-2026:10648-1anchor-related/openSUSE-SU-2026:10667-1anchor-related/openSUSE-SU-2026:11068-1anchor-related/openSUSE-SU-2026:11100-1anchor-related/openSUSE-SU-2026:11181-1anchor-related/openSUSE-SU-2026:21459-1agent/typeagent/titleagent/first-publish-dateagent/descriptionagent/referencesagent/eventagent/last-modified-dateagent/sourceagent/severityagent/risk-scoreagent/guess-aiagent/tagsagent/softwarecombinevendor/go projectcanonical/go project net/http

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.