There is a MEDIUM severity vulnerability affecting CPython.

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

Please see the linked CVE ID for the latest information on affected versions:

• https://www.cve.org/CVERecord?id=CVE-2025-15282
• https://github.com/python/cpython/pull/143926