]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.13] gh-150743: Limit trailer lines and interim responses read by http.client ...
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Sun, 28 Jun 2026 19:55:34 +0000 (21:55 +0200)
committerGitHub <noreply@github.com>
Sun, 28 Jun 2026 19:55:34 +0000 (19:55 +0000)
commitd804d2817b58c8a637d34dac53114f1a11f50cc5
treece62a2c6da20a5cf8575286015bcb97a32f7a8b8
parent7c6d5296875d98f9697540acc75b7a52df93c3a6
[3.13] gh-150743: Limit trailer lines and interim responses read by http.client (GH-150749) (#152526)

http.client read chunked-response trailer lines and skipped interim (1xx)
responses in unbounded loops, so a server streaming either forever would
hang the client even with a socket timeout set (data keeps arriving, so
the timeout never fires).

Trailer lines are now limited to max_response_headers (100 by default)
and interim responses to 100; HTTPException is raised past either limit.

Follow-up to gh-88188 for CVE-2021-3737, which bounded header lines
within an interim response but not these two sibling loops.
(cherry picked from commit 84badb77f5bb26e51d9a5c478d0e3bfe7ab6eb6f)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
---

This issue was reported to us via [GHSA-w4q2-g22w-6fr4](https://github.com/python/cpython/security/advisories/GHSA-w4q2-g22w-6fr4)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Lib/http/client.py
Lib/test/test_httplib.py
Misc/NEWS.d/next/Security/2026-05-30-00-00-00.gh-issue-150743.httpdos.rst [new file with mode: 0644]