ilusha/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython synced 2026-10-30 08:11:56 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
cpython/Lib/http
History
Exact
Miss Islington (bot) a51c52062a
[3.12] gh-150743: Limit trailer lines and interim responses read by http.client (GH-150749) (#152527) 
[3.14] gh-150743: Limit trailer lines and interim responses read by http.client (GH-150749)

http.client read chunked-response trailer lines and skipped interim (1xx)
responses in unbounded loops, so a server streaming either forever would
hang the client even with a socket timeout set (data keeps arriving, so
the timeout never fires).

Trailer lines are now limited to max_response_headers (100 by default)
and interim responses to 100; HTTPException is raised past either limit.

Follow-up to gh-88188 for CVE-2021-3737, which bounded header lines
within an interim response but not these two sibling loops.
(cherry picked from commit 84badb77f5)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

---

This issue was reported to us via [GHSA-w4q2-g22w-6fr4](https://github.com/python/cpython/security/advisories/GHSA-w4q2-g22w-6fr4)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
2026-08-04 11:27:42 +02:00
..
__init__.py
client.py [3.12] gh-150743: Limit trailer lines and interim responses read by http.client (GH-150749) (#152527) 2026-08-04 11:27:42 +02:00
cookiejar.py
cookies.py [3.12] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) (#146025) 2026-08-04 11:16:44 +02:00
server.py [3.12] gh-119452: Fix a potential virtual memory allocation denial of service in http.server (GH-142216) (#142297) 2025-12-15 15:11:38 +01:00