Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-0865: Apache WSGI Header Injection in Apache WSGI
CVE-2026-0865 · published 9 months ago
Summary
Apache WSGI's header handling can allow attackers to inject malicious HTTP headers if user-controlled headers contain newlines. This can potentially allow an attacker to manipulate the way a web application responds. Patch the affected software to prevent this attack vector.
What to do
- Update python-min to version 3.14.3.
- Update python to version 3.14.3.
- Update libpython to version 3.14.3.
- Update debian rootio-python3.13 to version 3.13.5-2.root.io.14.
- Update debian rootio-python3.11 to version 3.11.2-6+deb12u6.root.io.28.
- Update debian rootio-python3.11 to version 3.11.2-6+deb12u6.root.io.32.
- Update debian pypy3 to version 7.3.21+dfsg-1.
- Update debian python3.11 to version 3.11.2-6+deb12u7.
- Update debian python3.13 to version 3.13.5-2+deb13u1.
- Update debian python3.13 to version 3.13.12-1.
- Update debian python3.14 to version 3.14.3-1.
- Update debian python3.9 to version 3.9.2-1+deb11u5.
- Update debian rootio-python3.11 to version 3.11.2-6+deb12u6.root.io.25.
- Update debian rootio-python3.11 to version 3.11.2-6+deb12u6.root.io.31.
- Update debian rootio-python3.11 to version 3.11.2-6+deb12u6.root.io.33.
- Update debian rootio-python3.13 to version 3.13.5-2.root.io.16.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | python-min |
>= 3.14.0, < 3.14.3 Fix: upgrade to 3.14.3
|
| Bitnami | – | python |
>= 3.14.0, < 3.14.3 Fix: upgrade to 3.14.3
|
| Bitnami | – | libpython |
>= 3.14.0, < 3.14.3 Fix: upgrade to 3.14.3
|
| Root:Debian:13 | debian | rootio-python3.13 |
< 3.13.5-2.root.io.14 < 3.13.5-2.root.io.16 Fix: upgrade to 3.13.5-2.root.io.14
|
| Root:Debian:12 | debian | rootio-python3.11 |
< 3.11.2-6+deb12u6.root.io.28 < 3.11.2-6+deb12u6.root.io.32 < 3.11.2-6+deb12u6.root.io.25 < 3.11.2-6+deb12u6.root.io.31 < 3.11.2-6+deb12u6.root.io.33 Fix: upgrade to 3.11.2-6+deb12u6.root.io.28
|
| Debian:11 | debian | jython | All versions |
| Debian:12 | debian | jython | All versions |
| Debian:13 | debian | jython | All versions |
| Debian:14 | debian | jython | All versions |
| Debian:11 | debian | pypy3 | All versions |
| Debian:12 | debian | pypy3 | All versions |
| Debian:13 | debian | pypy3 | All versions |
| Debian:14 | debian | pypy3 |
< 7.3.21+dfsg-1 Fix: upgrade to 7.3.21+dfsg-1
|
| Debian:11 | debian | python2.7 | All versions |
| Debian:12 | debian | python3.11 |
< 3.11.2-6+deb12u7 Fix: upgrade to 3.11.2-6+deb12u7
|
| Debian:13 | debian | python3.13 |
< 3.13.5-2+deb13u1 Fix: upgrade to 3.13.5-2+deb13u1
|
| Debian:14 | debian | python3.13 |
< 3.13.12-1 Fix: upgrade to 3.13.12-1
|
| Debian:14 | debian | python3.14 |
< 3.14.3-1 Fix: upgrade to 3.14.3-1
|
| Debian:11 | debian | python3.9 |
< 3.9.2-1+deb11u5 Fix: upgrade to 3.9.2-1+deb11u5
|
Original advisory text
wsgiref.headers.Headers allows header newline injection
User-controlled header names and values containing newlines can allow injecting HTTP headers.
References
- https://security-tracker.debian.org/tracker/CVE-2026-0865 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0865.j... Vendor Advisory
- https://mail.python.org/archives/list/[email protected]/thread/BJ6QPH... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-0865 Vendor Advisory
- https://github.com/python/cpython/issues/143916 Third Party Advisory
- https://github.com/python/cpython/commit/22e4d55285cee52bc4dbe061324e5f30bd4dee5... Patch
- https://github.com/python/cpython/commit/23e3c0ae867cca0130e441e776c9955b9027c51... Patch
- https://github.com/python/cpython/commit/286e3ac39984fe85a17f4ab39c64d382137aae5... Patch
- https://github.com/python/cpython/commit/2f840249550e082dc351743f474ba56da10478d... Patch
- https://github.com/python/cpython/commit/4802b96a2cde58570c24c13ef3289490980961c... Patch
- https://github.com/python/cpython/commit/66da7bf6fe7b81e3ecc9c0a25bd47d4616c8d1a... Patch
- https://github.com/python/cpython/commit/83ecd18779f286d872f68bfce175651e407d9ff... Patch
- https://github.com/python/cpython/commit/8bb044d29310bb05d15086cdaa8bf64867d61a9... Patch
- https://github.com/python/cpython/commit/bfba660085767f8c2d582134e9d511a85eda04c... Patch
- https://github.com/python/cpython/commit/c592227ffb48679af9845a45dbb0875d975bb21... Patch
- https://github.com/python/cpython/commit/e4846a93ac07a8ae9aa18203af0dd13d6e7a699... Patch
- https://github.com/python/cpython/commit/f7fceed79ca1bceae8dbe5ba5bc8928564da721... Patch
- https://github.com/python/cpython/pull/143917 Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-74Injection
Timeline
Published20 Jan 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-0865 · OSV
CVE-2026-0865 · NVD
BIT-libpython-2026-0865 · OSV
BIT-python-min-2026-0865 · OSV
DEBIAN-CVE-2026-0865 · OSV
Track software like this
Free during beta