BSD PortsPython -- HTTP proxy CONNECT tunnel does not sanitize CR/LF
Seth Larson reports: HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF (CVE-2026-1502).
Affected versions
- python310 < 3.10.21
- python311 < 3.11.16
- python312 < 3.12.13_3
- python313 < 3.13.14
- python313t < 3.13.14
- python314 < 3.14.4
By system
2 still vulnerable, 6 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | lang/python310 | 3.10.17_1 | vulnerable since 2026-04-12 | |
| NetBSD | lang/python310 | 3.10.21 | not listed | |
| GhostBSD | lang/python310 | 3.10.21 | fixed | |
| DragonFly | lang/python311 | 3.11.12_1 | vulnerable since 2026-04-12 | |
| NetBSD | lang/python311 | 3.11.16 | not listed | |
| MidnightBSD | lang/python311 | in range, by version | ||
| FreeBSD | lang/python311 | 3.11.17 | fixed | |
| FreeBSD | lang/python312 | 3.12.15 | fixed | |
| NetBSD | lang/python312 | 3.12.14 | not listed | |
| MidnightBSD | lang/python312 | in range, by version | ||
| FreeBSD | lang/python313 | 3.13.16 | fixed | |
| NetBSD | lang/python313 | 3.13.15 | not listed | |
| MidnightBSD | lang/python313 | in range, by version | ||
| FreeBSD | lang/python313t | 3.13.16 | fixed | |
| MidnightBSD | lang/python313t | in range, by version | ||
| FreeBSD | lang/python314 | 3.14.8 | fixed | |
| NetBSD | lang/python314 | 3.14.7 | not listed | |
| MidnightBSD | lang/python314 | in range, by version |