CVE-2026-1502 is a medium-severity CPython vulnerability published in April 2026 in which Python’s HTTP client proxy tunneling code failed to reject carriage-return and line-feed characters in tunnel host and header values. The bug matters less because it is spectacular and more because it sits...
