User-controlled HTTP header names or values that include newline characters can be used to inject additional headers into the response. This header injection vulnerability may enable attackers to modify or add HTTP headers, potentially leading to HTTP response splitting, cache poisoning, or application logic manipulation. The flaw originates from the lack of sanitization in Python's wsgiref.headers module and is classified as a Header Injection weakness (CWE‑74).

The vulnerability affects the CPython implementation of the Python Software Foundation. Any deployment that employs the wsgiref.headers class without the patch—primarily Python web servers or applications that use the wsgiref module—is potentially impacted. Affected version details were not disclosed in the provided data.

The CVSS score of 5.9 indicates a moderate impact, while an EPSS score of less than 1% suggests a low exploitation probability at this time. The issue does not appear in the CISA KEV catalog, implying no confirmed widespread exploitation. The likely attack vector is remote, via an HTTP request constructed by an attacker that includes newlines in header names or values processed by wsgiref.headers. An attacker could construct such a request to influence the server's response headers before application logic is applied.