meta-openembedded/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-50269.patch

From a8ea4a13b9691357fdc7796506b0c85566ed1985 Mon Sep 17 00:00:00 2001
From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com>
Date: Thu, 28 May 2026 23:57:41 +0100
Subject: [PATCH] [PR #12719/879d48d1 backport][3.14] Reject invalid bytes in
 multipart/payload headers (#12720)

**This is a backport of PR #12719 as merged into master
(879d48d1619b9bc3662037afcb8bfa790a205e9b).**

CVE: CVE-2026-50269
Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8]

Backport Changes:
- Backported the pure-Python http_writer._safe_header()
  control-character validation from prerequisite commit
  1e3ecd48ec423c1fcc729c98adff31172faae1ef because aiohttp
  3.9.5 rejects only CR/LF and the upstream CVE regression test
  also requires NUL rejection.
- Adapted the prerequisite regression coverage to test _safe_header()
  directly using the aiohttp 3.9.5 test layout. Omitted its C
  serializer, threat-model, changelog, and broader serializer-test
  changes because Payload._binary_headers invokes the pure-Python
  helper directly.

Co-authored-by: Sam Bull <git@sambull.org>
(cherry picked from commit 1e3ecd48ec423c1fcc729c98adff31172faae1ef)
(cherry picked from commit bf88077ebb14f4c29924b8e8904cba20c55c28b8)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 CHANGES/12706.bugfix.rst  |  1 +
 aiohttp/http_writer.py    | 10 ++++++++--
 aiohttp/payload.py        |  8 +++++---
 tests/test_http_writer.py | 19 +++++++++++++++++++
 tests/test_payload.py     | 15 +++++++++++++++
 5 files changed, 48 insertions(+), 5 deletions(-)
 create mode 100644 CHANGES/12706.bugfix.rst

diff --git a/CHANGES/12706.bugfix.rst b/CHANGES/12706.bugfix.rst
new file mode 100644
index 000000000..9248585f9
--- /dev/null
+++ b/CHANGES/12706.bugfix.rst
@@ -0,0 +1 @@
+Fixed invalid bytes being allowed in multipart/payload headers -- by :user:`Dreamsorcerer`.
diff --git a/aiohttp/http_writer.py b/aiohttp/http_writer.py
index 37cdc06e6..9573768f6 100644
--- a/aiohttp/http_writer.py
+++ b/aiohttp/http_writer.py
@@ -1,6 +1,7 @@
 """Http related parsers and protocol."""
 
 import asyncio
+import re
 import zlib
 from typing import Any, Awaitable, Callable, NamedTuple, Optional, Union  # noqa
 
@@ -171,10 +172,15 @@ class StreamWriter(AbstractStreamWriter):
             await self._protocol._drain_helper()
 
 
+# https://www.rfc-editor.org/info/rfc9110/#section-5.5-5
+# https://www.rfc-editor.org/info/rfc9112/#section-4-3
+_FORBIDDEN_HEADER_CHARS_RE = re.compile(r"[\x00-\x08\x0a-\x1f\x7f]")
+
+
 def _safe_header(string: str) -> str:
-    if "\r" in string or "\n" in string:
+    if _FORBIDDEN_HEADER_CHARS_RE.search(string) is not None:
         raise ValueError(
-            "Newline or carriage return detected in headers. "
+            "Forbidden control character detected in headers. "
             "Potential header injection attack."
         )
     return string
diff --git a/aiohttp/payload.py b/aiohttp/payload.py
index 6593b05c6..77caf520c 100644
--- a/aiohttp/payload.py
+++ b/aiohttp/payload.py
@@ -33,6 +33,7 @@ from .helpers import (
     parse_mimetype,
     sentinel,
 )
+from .http_writer import _safe_header
 from .streams import StreamReader
 from .typedefs import JSONEncoder, _CIMultiDict
 
@@ -180,9 +181,10 @@ class Payload(ABC):
     @property
     def _binary_headers(self) -> bytes:
         return (
-            "".join([k + ": " + v + "\r\n" for k, v in self.headers.items()]).encode(
-                "utf-8"
-            )
+            "".join(
+                _safe_header(k) + ": " + _safe_header(v) + "\r\n"
+                for k, v in self.headers.items()
+            ).encode("utf-8")
             + b"\r\n"
         )
 
diff --git a/tests/test_http_writer.py b/tests/test_http_writer.py
index 5649f32f7..62d112cad 100644
--- a/tests/test_http_writer.py
+++ b/tests/test_http_writer.py
@@ -6,6 +6,7 @@ import pytest
 from multidict import CIMultiDict
 
 from aiohttp import http
+from aiohttp.http_writer import _safe_header
 from aiohttp.test_utils import make_mocked_coro
 
 
@@ -264,6 +265,24 @@ async def test_drain_no_transport(protocol, transport, loop) -> None:
     assert not protocol._drain_helper.called
 
 
+@pytest.mark.parametrize(
+    "char",
+    [chr(c) for c in (*range(0x00, 0x09), *range(0x0A, 0x20), 0x7F)],
+)
+def test_safe_header_rejects_forbidden_control_chars(char: str) -> None:
+    with pytest.raises(
+        ValueError,
+        match="Forbidden control character detected in headers",
+    ):
+        _safe_header(f"value{char}")
+
+
+def test_safe_header_allows_htab() -> None:
+    value = "text/plain\tcharset=utf-8"
+
+    assert _safe_header(value) == value
+
+
 async def test_write_headers_prevents_injection(protocol, transport, loop) -> None:
     msg = http.StreamWriter(protocol, loop)
     status_line = "HTTP/1.1 200 OK"
diff --git a/tests/test_payload.py b/tests/test_payload.py
index c8681cb5e..52ace65fd 100644
--- a/tests/test_payload.py
+++ b/tests/test_payload.py
@@ -54,6 +54,21 @@ def test_payload_content_type() -> None:
     assert p.content_type == "application/json"
 
 
+@pytest.mark.parametrize("bad_byte", ("\r", "\n", "\x00"))
+def test_binary_headers_reject_injection_in_value(bad_byte: str) -> None:
+    p = Payload("test", headers={"X-Custom": f"value{bad_byte}Injected: bad"})
+    with pytest.raises(ValueError, match="header injection"):
+        p._binary_headers
+
+
+@pytest.mark.parametrize("bad_byte", ("\r", "\n", "\x00"))
+def test_binary_headers_reject_injection_in_name(bad_byte: str) -> None:
+    p = Payload("test")
+    p.headers[f"X-Custom{bad_byte}Injected"] = "value"
+    with pytest.raises(ValueError, match="header injection"):
+        p._binary_headers
+
+
 def test_bytes_payload_default_content_type() -> None:
     p = payload.BytesPayload(b"data")
     assert p.content_type == "application/octet-stream"
-- 
2.35.6