Gregory P. Smith 41cc78a7a4 gh-150743: Limit trailer lines and interim responses read by http.client (GH-150741) ...

http.client read chunked-response trailer lines and skipped interim (1xx)
responses in unbounded loops, so a server streaming either forever would
hang the client even with a socket timeout set (data keeps arriving, so
the timeout never fires).

Trailer lines are now limited to max_response_headers (100 by default)
and interim responses to 100; HTTPException is raised past either limit.

Follow-up to gh-88188 for CVE-2021-3737, which bounded header lines
within an interim response but not these two sibling loops.

---

This issue was reported to us via [GHSA-w4q2-g22w-6fr4](https://github.com/python/cpython/security/advisories/GHSA-w4q2-g22w-6fr4) and was determined not to be high enough severity to handle privately.

2026-06-28 12:06:41 -07:00

..

__init__.py

…

client.py

gh-150743: Limit trailer lines and interim responses read by http.client (GH-150741)

2026-06-28 12:06:41 -07:00

cookiejar.py

…

cookies.py

gh-149144: Use decodeURIComponent() for UTF-8 support in js_output() (GH-149157)

2026-05-14 23:10:39 +02:00

server.py

gh-142389: Add backticks to stdlib argparse help to display in colour (#149384)

2026-05-04 22:23:18 +00:00