Skip to main content

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

Vulnerability IntelligencePSF-2026-2

PSF-2026-2

UNKNOWN

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

Published Jan 20, 2026

Modified 1 months ago

Fix available

Details

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

Affected Packages

Python

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1809) / Server 2019Windows 10 (1903)Windows 10 (1909)

Fixed in:

3.10.203.11.153.12.133.13.123.14.33.15.0a6

References

https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0

https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38

https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80

https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47

https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a

https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f

https://github.com/python/cpython/issues/143925

https://github.com/python/cpython/pull/143926

https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/

Aliases

Ecosystems(20)

Windows 10 (1507)Windows 10 (1607) / Server 2016 Windows 10 (1809) / Server 2019 Windows 10 (1903)Windows 10 (1909)

Timeline

PublishedJan 20, 2026

ModifiedJan 26, 2026

PSF-2026-2 | Mondoo Vulnerability Intelligence