CVE-2026-0865: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-0865 is an HTTP header injection vulnerability in Python's wsgiref.headers.Headers class, caused by insufficient validation of user-controlled header names and values containing newline characters (C0 control characters). It affects CPython versions prior to 3.15.0 and was disclosed on January 20, 2026, by the Python Software Foundation (PSF). The vulnerability has a CVSS v4.0 base score of 5.9 (Medium), requiring high privileges and specific attack conditions (IBM Advisory, CPython Issue). Downstream IBM products including CICS Transaction Gateway for Multiplatforms and IBM Cloud Pak for Data System 1.0 are also affected (IBM Advisory).

The root cause is improper neutralization of special elements in output used by a downstream component (CWE-74), specifically the failure of wsgiref.headers.Headers to reject C0 control characters (byte range 0x00–0x1F and 0x7F) in header names, values, and parameters. An attacker with the ability to influence header values passed to the Headers class can embed newline sequences (e.g., \r\n) to inject arbitrary HTTP headers into WSGI responses. The fix adds a regex check (_control_chars_re = re.compile(r'[\x00-\x1F\x7F]')) in the _convert_string_type method of Lib/wsgiref/headers.py, raising a ValueError when control characters are detected (CPython PR #143917, Commit 22e4d55). Exploitation requires that the attacker control data that is passed as a header name or value in a WSGI application using the vulnerable wsgiref module.

Successful exploitation allows an attacker to inject arbitrary HTTP headers into server responses, enabling attacks such as HTTP response splitting, cache poisoning, session fixation, and potential credential theft. The primary impact is on integrity (CVSS VI:H), with no direct confidentiality or availability impact. Applications using Python's wsgiref module that pass user-controlled data into HTTP response headers without additional sanitization are at risk, and the vulnerability could be leveraged to manipulate downstream clients or caching infrastructure (IBM Advisory, CPython Issue).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-0865. The EPSS score is approximately 0.067%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (PR:H) and specific attack conditions (AT:P), limiting the practical attack surface (IBM Advisory).

1. Identify target: Locate a WSGI application built on Python's wsgiref module (versions < 3.15.0) that accepts user-controlled input and passes it as an HTTP response header name or value without sanitization.
2. Craft malicious input: Prepare a payload containing a newline sequence (e.g., \r\n) embedded in a header value, such as legitimate-value\r\nInjected-Header: malicious.
3. Trigger header injection: Submit the crafted input through an application endpoint that incorporates user data into a wsgiref.headers.Headers object (e.g., via a form field, URL parameter, or API request that is reflected in a response header).
4. Achieve injection: The unpatched wsgiref module passes the value through without validation, causing the injected newline to split the HTTP response and insert the attacker-controlled header into the response sent to the client or intermediary cache.
5. Exploit downstream effects: Use the injected header to perform cache poisoning, session fixation, or redirect attacks against users or caching proxies (CPython PR #143917, CPython Issue).

• Logs: HTTP response logs showing unexpected or duplicate headers in WSGI application responses; error logs showing ValueError: Control characters not allowed in headers after patching (indicating attempted exploitation).
• Network: HTTP responses containing injected headers with unusual names or values; responses with unexpected \r\n sequences splitting header fields; anomalous Set-Cookie or Location headers not generated by application logic.
• Application: WSGI application logs showing user-supplied data being passed directly to header construction functions without sanitization.

The Python Software Foundation patched this vulnerability by adding C0 control character validation in Lib/wsgiref/headers.py. Fixes were backported to CPython branches 3.10, 3.11, 3.12, 3.13, and 3.14 (CPython PR #143917). Users should upgrade to a patched Python release (≥ 3.15.0 or a patched minor release for 3.10–3.14). As a workaround, applications should sanitize all user-controlled data before passing it to wsgiref.headers.Headers, explicitly rejecting any input containing characters in the range \x00–\x1F or \x7F. IBM has released patches for affected products including CICS Transaction Gateway for Multiplatforms and IBM Cloud Pak for Data System 1.0 (IBM Advisory, IBM Cloud Pak Advisory). Linux distributions including Red Hat, Ubuntu, Debian, SUSE, Fedora, and Amazon Linux have also issued updated packages.

The vulnerability was reported by Seth Michael Larson (PSF Security Developer-in-Residence) and fixed promptly with backports across all supported Python branches. The fix was announced via the Python security mailing list and coordinated with major Linux distributions, resulting in rapid patch availability across Red Hat, Ubuntu, Debian, SUSE, Fedora, AlmaLinux, Rocky Linux, and Amazon Linux. Community discussion was largely technical and focused on the backport process, with no significant controversy (Python Security Announce, oss-sec).