python · vstinner · Apr 2, 2026 · Jan 3, 2026 · Jan 4, 2026 · Jan 4, 2026
diff --git a/Doc/library/http.server.rst b/Doc/library/http.server.rst
@@ -287,6 +287,8 @@ instantiation, of which this module provides three different variants:
      specifying its value. Note that, after the send_header calls are done,
      :meth:`end_headers` MUST BE called in order to complete the operation.

+      This method does not reject input containing CRLF sequences.
+
      .. versionchanged:: 3.2
         Headers are stored in an internal buffer.

@@ -297,6 +299,8 @@ instantiation, of which this module provides three different variants:
      buffered and sent directly the output stream.If the *message* is not
      specified, the HTTP message corresponding the response *code*  is sent.

+      This method does not reject *message* containing CRLF sequences.
+
      .. versionadded:: 3.2

   .. method:: end_headers()
@@ -555,6 +559,11 @@ Security considerations
 requests, this makes it possible for files outside of the specified directory
 to be served.

+Methods :meth:`BaseHTTPRequestHandler.send_header` and
+:meth:`BaseHTTPRequestHandler.send_response_only` assume sanitized input
+and does not perform input validation such as checking for the presence of CRLF
+sequences. Untrusted input may result in HTTP Header injection attacks.
+
 Earlier versions of Python did not scrub control characters from the
 log messages emitted to stderr from ``python -m http.server`` or the
 default :class:`BaseHTTPRequestHandler` ``.log_message``