PSF-2026-6: wsgiref.headers.Headers allows header newline injection

Published Jan 20, 2026

Updated

User-controlled header names and values containing newlines can allow injecting HTTP headers.

Affected Software

1 affected component

Python Software Foundation wsgiref.headers.Headers

Event History

Jan 20, 2026

CVE Published

via OSV·09:26 PM

Data Sourced

via OSV·09:26 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access and conditions does an attacker need?

The attack vector is network-based, but exploitation requires high privileges and additional attack requirements. The attacker must also be able to cause newline-containing data to be used as HTTP header names or values.

What is the primary security impact?

The reported impact is on integrity, including high impact to the vulnerable component's integrity. No confidentiality or availability impact is identified in the supplied vector.

Which deployments are most relevant to investigate?

Investigate applications using wsgiref.headers.Headers where header names or values can be influenced by users, especially if those inputs are not validated to reject newlines. The provided information does not state whether default configurations are affected.

PSF-2026-6: wsgiref.headers.Headers allows header newline injection

Affected Software

Event History

Frequently Asked Questions

What access and conditions does an attacker need?

What is the primary security impact?

Which deployments are most relevant to investigate?

Company

Resources

Contact

Frequently Asked Questions

What access and conditions does an attacker need?

What is the primary security impact?

Which deployments are most relevant to investigate?