The vulnerability arises because the CPython HTTP client does not reject CR or LF characters in proxy tunnel headers or host values. This omission allows an attacker to inject arbitrary HTTP headers or to split an HTTP response, leading to response‑splitting attacks. Consequently, the application could unknowingly serve manipulated content, potentially enabling session hijacking, content spoofing, or other attacks linked to header injection weaknesses.

The issue affects the built‑in HTTP client of CPython. Any CPython installation that uses the default proxy handling code and has not incorporated the patch referenced by the commit 05ed7ce7e… is vulnerable.

The CVSS score of 5.7 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not present in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to direct a crafted HTTP request containing CR/LF characters through a proxy tunnel to an application using CPython’s HTTP client. Once the header is accepted, the injected line breaks can be used to manipulate the response and potentially achieve further exploitation.