CVE-2026-0865: wsgiref.headers.Headers allows header newline injection
Published Jan 20, 2026
·Updated
User-controlled header names and values containing newlines can allow injecting HTTP headers.
Affected Software
2 affected components
wsgiref/headers
IBM Netezza Software<=11.3.0.3-IF2
Event History
Jan 20, 2026
CVE Published
via MITRE·09:26 PM
Data Sourced
via MITRE·09:26 PM
DescriptionWeakness
Data Sourced
via Red Hat·10:01 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeakness
Aug 20, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-0865?
CVE-2026-0865 has been classified as a medium severity vulnerability due to the potential for HTTP header injection.
2
How do I fix CVE-2026-0865?
To fix CVE-2026-0865, ensure that your application properly sanitizes user input for header names and values, especially to prevent newlines.
3
What software is affected by CVE-2026-0865?
CVE-2026-0865 affects the wsgiref package, specifically versions vulnerable to header newline injection.
4
What are the risks associated with CVE-2026-0865?
The risks associated with CVE-2026-0865 include the potential for an attacker to inject malicious headers, compromising web application security.
5
Is there a patch available for CVE-2026-0865?
Yes, a patch addressing CVE-2026-0865 is available and should be applied to prevent header injection vulnerabilities.