Improper HTTP Response Parsing in Python's CPython Distribution
CVE-2026-103995

2LOW

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
27 October 2026

What is CVE-2026-103995?

This vulnerability in Python's CPython affects the way response body and chunk parsing processes non-hexadecimal or negative integers. Such improper handling could lead to incorrect interpretations of HTTP response contents, potentially affecting the security and functionality of applications relying on this parsing mechanism.

Affected Version(s)

CPython 0 < 3.16.0

References

https://github.com/python/cpython/pull/150752
patch
https://github.com/python/cpython/issues/150751
issue-tracking

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ekalabya Ghosh (https://github.com/not-ekalabya)
metsw24-max (https://github.com/metsw24-max)
Seth Larson (https://github.com/sethmlarson)
Petr Viktorin (https://github.com/encukou)
.