https://github.com/python/cpython/commit/1790e584142b5db070b74bc64777ad14e26608c2
commit: 1790e584142b5db070b74bc64777ad14e26608c2
branch: 3.10
author: Miss Islington (bot) <[email protected]>
committer: pablogsal <[email protected]>
date: 2026-06-28T22:50:36+02:00
summary:
[3.10] gh-150743: Limit trailer lines and interim responses read by http.client
(GH-150749) (#152529)
files:
A Misc/NEWS.d/next/Security/2026-05-30-00-00-00.gh-issue-150743.httpdos.rst
M Lib/http/client.py
M Lib/test/test_httplib.py
diff --git a/Lib/http/client.py b/Lib/http/client.py
index 2a8f55f2a47159..c05d33b79cc15f 100644
--- a/Lib/http/client.py
+++ b/Lib/http/client.py
@@ -111,6 +111,13 @@
_MAXLINE = 65536
_MAXHEADERS = 100
+# maximal number of interim (1xx) responses tolerated before the final
+# response. Real servers send at most a few; without a bound, a server
+# streaming "100 Continue" responses would hang getresponse() forever.
+# A socket timeout cannot detect that as data keeps arriving within every
+# timeout window.
+_MAXINTERIMRESPONSES = 100
+
# Data larger than this will be read in chunks, to prevent extreme
# overallocation.
_MIN_READ_BUF_SIZE = 1 << 20
@@ -319,7 +326,7 @@ def begin(self):
return
# read until we get a non-100 response
- while True:
+ for _ in range(_MAXINTERIMRESPONSES):
version, status, reason = self._read_status()
if status != CONTINUE:
break
@@ -328,6 +335,9 @@ def begin(self):
if self.debuglevel > 0:
print("headers:", skipped_headers)
del skipped_headers
+ else:
+ raise HTTPException(
+ f"got more than {_MAXINTERIMRESPONSES} interim responses")
self.code = self.status = status
self.reason = reason.strip()
@@ -545,6 +555,7 @@ def _read_next_chunk_size(self):
def _read_and_discard_trailer(self):
# read and discard trailer up to the CRLF terminator
### note: we shouldn't have any trailers!
+ trailers_read = 0
while True:
line = self.fp.readline(_MAXLINE + 1)
if len(line) > _MAXLINE:
@@ -555,6 +566,14 @@ def _read_and_discard_trailer(self):
break
if line in (b'\r\n', b'\n', b''):
break
+ # Bound the trailer count just as response headers are bounded.
+ # A server streaming trailer lines forever would otherwise hang
+ # the client; a socket timeout cannot detect that as data keeps
+ # arriving within every timeout window.
+ trailers_read += 1
+ if trailers_read > _MAXHEADERS:
+ raise HTTPException(
+ f"got more than {_MAXHEADERS} trailers")
def _get_chunk_left(self):
# return self.chunk_left, reading a new chunk if necessary.
diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
index 3e2ab68e98f1fd..19670c5f756ab5 100644
--- a/Lib/test/test_httplib.py
+++ b/Lib/test/test_httplib.py
@@ -1093,6 +1093,35 @@ def test_overflowing_header_limit_after_100(self):
self.assertIn('got more than ', str(cm.exception))
self.assertIn('headers', str(cm.exception))
+ def test_too_many_interim_responses(self):
+ # A server streaming "100 Continue" responses forever must not
+ # hang getresponse().
+ body = (
+ 'HTTP/1.1 100 Continue\r\n\r\n'
+ * (client._MAXINTERIMRESPONSES + 1)
+ )
+ resp = client.HTTPResponse(FakeSocket(body))
+ with self.assertRaises(client.HTTPException) as cm:
+ resp.begin()
+ self.assertIn('got more than ', str(cm.exception))
+ self.assertIn('interim responses', str(cm.exception))
+
+ def test_multiple_interim_responses(self):
+ # A reasonable number of interim responses before the final
+ # response is skipped as before.
+ body = (
+ 'HTTP/1.1 100 Continue\r\n\r\n' * 3 +
+ 'HTTP/1.1 200 OK\r\n'
+ 'Content-Length: 5\r\n'
+ '\r\n'
+ 'hello'
+ )
+ resp = client.HTTPResponse(FakeSocket(body), method="GET")
+ resp.begin()
+ self.assertEqual(resp.status, 200)
+ self.assertEqual(resp.read(), b'hello')
+ resp.close()
+
def test_overflowing_chunked_line(self):
body = (
'HTTP/1.1 200 OK\r\n'
@@ -1164,6 +1193,35 @@ def test_chunked_trailers(self):
self.assertEqual(sock.file.read(), b"") #we read to the end
resp.close()
+ def test_chunked_too_many_trailers(self):
+ """A response streaming endless trailer lines must raise, not hang"""
+ too_many_trailers = "".join(
+ f"X-Trailer{i}: {i}\r\n" for i in range(client._MAXHEADERS + 1)
+ )
+ # An unbounded read() reaches the trailers via the final 0 chunk.
+ sock = FakeSocket(
+ chunked_start + last_chunk + too_many_trailers + chunked_end)
+ resp = client.HTTPResponse(sock, method="GET")
+ resp.begin()
+ with self.assertRaisesRegex(
+ client.HTTPException,
+ f"got more than {client._MAXHEADERS} trailers",
+ ):
+ resp.read()
+ resp.close()
+
+ # A bounded read(amt) larger than the body hits the same limit.
+ sock = FakeSocket(
+ chunked_start + last_chunk + too_many_trailers + chunked_end)
+ resp = client.HTTPResponse(sock, method="GET")
+ resp.begin()
+ with self.assertRaisesRegex(
+ client.HTTPException,
+ f"got more than {client._MAXHEADERS} trailers",
+ ):
+ resp.read(len(chunked_expected) + 1)
+ resp.close()
+
def test_chunked_sync(self):
"""Check that we don't read past the end of the chunked-encoding
stream"""
expected = chunked_expected
diff --git
a/Misc/NEWS.d/next/Security/2026-05-30-00-00-00.gh-issue-150743.httpdos.rst
b/Misc/NEWS.d/next/Security/2026-05-30-00-00-00.gh-issue-150743.httpdos.rst
new file mode 100644
index 00000000000000..4cc4e4b092da71
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2026-05-30-00-00-00.gh-issue-150743.httpdos.rst
@@ -0,0 +1,6 @@
+:mod:`http.client` now limits the number of chunked-response trailer lines
+it will read to 100, and the number of interim (1xx) responses it will
+skip to 100. A malicious or broken server could previously stream trailer
+lines or ``100 Continue`` responses forever, hanging the client even when
+a socket timeout was in use.
+Reported by ``@YLChen-007`` via GHSA-w4q2-g22w-6fr4.
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
