Security readout for executives and security teams
Plain-English summary
CPython’s http.client could accept carriage-return or line-feed characters in proxy tunnel headers or the host value. In affected applications, attacker-influenced values could alter the structure of an outbound proxy request, potentially compromising request integrity. The reported severity is medium, with material risk concentrated in applications that pass untrusted data into proxy-tunnel configuration.
Executive priority
Treat this as a targeted, moderate-priority remediation. Prioritize internet-facing or multi-tenant services that construct proxy tunnels from less-trusted input. Broad emergency action is not supported by the supplied evidence, but exposed applications should be reviewed promptly because successful abuse could compromise outbound request integrity.
Technical view
CVE-2026-1502 is a CWE-93 injection flaw caused by missing CR/LF validation in HTTP client proxy tunnel headers or host values. The CVSS 4.0 score is 5.7. The vector reports network reachability, low complexity, additional attack conditions, high privileges, passive user interaction, and high integrity impact without confidentiality or availability impact.
Likely exposure
Exposure is most likely where listed CPython versions use http.client proxy tunneling and allow attacker-controlled host or header values. The bundle lists 3.11.0, 3.12.0, 3.13.0, 3.14.0a1, and 3.15.0a1, but does not provide complete affected ranges or fixed release numbers.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Exploitation requires specific application behavior and the conditions reflected by CVSS, including high privileges and passive user interaction. Public issue and patch references exist, but their presence alone does not establish exploitation.
Researcher notes
The supplied record identifies CWE-93 and multiple upstream commits, but omits exact fixed release numbers and complete affected version ranges. Validate branch applicability through the vendor advisory, issue, and pull request. Avoid concluding that all Python HTTP clients or all releases are vulnerable; the stated scope is CPython http.client proxy tunnel headers or host handling.
Mitigation direction
- Review the Python security advisory and CPython issue for authoritative affected and fixed release details.
- Update to an official CPython release incorporating the referenced fixes when vendor guidance confirms availability.
- Prevent untrusted input from controlling proxy tunnel hosts or headers.
- Reject carriage-return and line-feed characters before values reach proxy tunnel configuration.
Validation and detection
- Inventory CPython versions and applications using http.client proxy tunneling.
- Trace whether external or lower-trust data can influence tunnel hosts or headers.
- Confirm installed builds include the applicable upstream patch or vendor-provided update.
- Add defensive tests verifying prohibited control characters are rejected without sending network traffic.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-93: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1502 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N——PSFVulnerability scoring details
Base CVSS 4.0 score
5.7MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/python/cpython/pull/146212CVE reference, PSF · patch
- https://github.com/python/cpython/issues/146211CVE reference, PSF · issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/CVE reference, PSF · vendor-advisory
- https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69CVE reference, PSF · patch
- https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2edCVE reference, PSF · patch
- https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8ddCVE reference, PSF · patch
- https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ecCVE reference, PSF · patch
- https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53CVE reference, PSF · patch
- https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3eCVE reference, PSF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of CRLF Sequences ('CRLF Injection')
Improper Neutralization of CRLF Sequences ('CRLF Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.