CVE-2026-103995
CVE-2026-103995 · Lenient parsing of integers for response body and chunk framing
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.
CVSS 2.0 · Low · EPSS 0.4% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
python
- Versions
- ≥ 0, < 3.16.0: Affected (python)
Update to 3.16.0
Original sources
- https://github.com/python/cpython/pull/150752
- https://github.com/python/cpython/issues/150751
- https://github.com/python/cpython/commit/2eb2af805c156ca52b316bb4ced5e0ab3971d0ae
- https://github.com/python/cpython/commit/9f52b443c002cccfb54bda0706a9276b6b4a109d
- https://nvd.nist.gov/vuln/detail/CVE-2026-103995