This issue is opened as public as the primary described CVE is already publicated and this only contains one certain point that has to be changed in code in Python.

In Lib/wsgiref/handlers.py at 260 (def _convert_string_type(self, value, title):) it is necessary to add the same fix as in #143916 requested as well.

Linked PRs

• gh-144370: Disallow usage of control characters in status in Lib/wsgiref/handlers.py for security #144371
• [3.13] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (GH-144371) #145585
• [3.14] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (GH-144371) #145586
• [3.12] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (GH-144371) #145671
• [3.11] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (#144371) #145672
• [3.10] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (#144371) #145673