Fix CVE-2025-15282 (bsc#1257046)

Add CVE-2025-15282-urllib-ctrl-chars.patch fixing bsc#1257046
  (CVE-2025-15282) using gh#python/cpython!143926 and doing
  basically the same as the previous patch for urllib library.

CVE-2025-12781-b64decode-alt-chars.patch

@@ -0,0 +1,196 @@
+From f922c02c529d25d61aa9c28a8192639c1fce8d4d Mon Sep 17 00:00:00 2001
+From: Serhiy Storchaka <storchaka@gmail.com>
+Date: Wed, 5 Nov 2025 20:12:31 +0200
+Subject: [PATCH] gh-125346: Add more base64 tests
+
+Add more tests for the altchars argument of b64decode() and for the map01
+argument of b32decode().
+---
+ Doc/library/base64.rst                                                  |   18 ++--
+ Lib/base64.py                                                           |   40 +++++++-
+ Lib/test/test_base64.py                                                 |   45 ++++++++--
+ Misc/NEWS.d/next/Library/2025-11-06-12-03-29.gh-issue-125346.7Gfpgw.rst |    5 +
+ 4 files changed, 91 insertions(+), 17 deletions(-)
+
+Index: Python-3.14.2/Doc/library/base64.rst
+===================================================================
+--- Python-3.14.2.orig/Doc/library/base64.rst	2025-12-05 17:49:16.000000000 +0100
++++ Python-3.14.2/Doc/library/base64.rst	2026-02-03 18:10:52.115333313 +0100
+@@ -77,15 +77,20 @@
+    A :exc:`binascii.Error` exception is raised
+    if *s* is incorrectly padded.
+ 
+-   If *validate* is ``False`` (the default), characters that are neither
++   If *validate* is false (the default), characters that are neither
+    in the normal base-64 alphabet nor the alternative alphabet are
+-   discarded prior to the padding check.  If *validate* is ``True``,
+-   these non-alphabet characters in the input result in a
+-   :exc:`binascii.Error`.
++   discarded prior to the padding check, but the ``+`` and ``/`` characters
++   keep their meaning if they are not in *altchars* (they will be discarded
++   in future Python versions).
++   If *validate* is true, these non-alphabet characters in the input
++   result in a :exc:`binascii.Error`.
+ 
+    For more information about the strict base64 check, see :func:`binascii.a2b_base64`
+ 
+-   May assert or raise a :exc:`ValueError` if the length of *altchars* is not 2.
++   .. deprecated:: next
++      Accepting the ``+`` and ``/`` characters with an alternative alphabet
++      is now deprecated.
++
+ 
+ .. function:: standard_b64encode(s)
+ 
+@@ -116,6 +121,9 @@
+    ``/`` in the standard Base64 alphabet, and return the decoded
+    :class:`bytes`.
+ 
++   .. deprecated:: next
++      Accepting the ``+`` and ``/`` characters is now deprecated.
++
+ 
+ .. function:: b32encode(s)
+ 
+Index: Python-3.14.2/Lib/base64.py
+===================================================================
+--- Python-3.14.2.orig/Lib/base64.py	2026-02-03 18:10:42.615516871 +0100
++++ Python-3.14.2/Lib/base64.py	2026-02-03 18:10:52.115801314 +0100
+@@ -69,20 +69,39 @@
+     The result is returned as a bytes object.  A binascii.Error is raised if
+     s is incorrectly padded.
+ 
+-    If validate is False (the default), characters that are neither in the
++    If validate is false (the default), characters that are neither in the
+     normal base-64 alphabet nor the alternative alphabet are discarded prior
+-    to the padding check.  If validate is True, these non-alphabet characters
++    to the padding check.  If validate is true, these non-alphabet characters
+     in the input result in a binascii.Error.
+     For more information about the strict base64 check, see:
+ 
+     https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
+     """
+     s = _bytes_from_decode_data(s)
++    badchar = None
+     if altchars is not None:
+         altchars = _bytes_from_decode_data(altchars)
+-        assert len(altchars) == 2, repr(altchars)
++        if len(altchars) != 2:
++            raise ValueError(f'invalid altchars: {altchars!r}')
++        for b in b'+/':
++            if b not in altchars and b in s:
++                badchar = b
++                break
+         s = s.translate(bytes.maketrans(altchars, b'+/'))
+-    return binascii.a2b_base64(s, strict_mode=validate)
++    result = binascii.a2b_base64(s, strict_mode=validate)
++    if badchar is not None:
++        import warnings
++        if validate:
++            warnings.warn(f'invalid character {chr(badchar)!a} in Base64 data '
++                          f'with altchars={altchars!r} and validate=True '
++                          f'will be an error in future Python versions',
++                          DeprecationWarning, stacklevel=2)
++        else:
++            warnings.warn(f'invalid character {chr(badchar)!a} in Base64 data '
++                          f'with altchars={altchars!r} and validate=False '
++                          f'will be discarded in future Python versions',
++                          FutureWarning, stacklevel=2)
++    return result
+ 
+ 
+ def standard_b64encode(s):
+@@ -127,8 +146,19 @@
+     The alphabet uses '-' instead of '+' and '_' instead of '/'.
+     """
+     s = _bytes_from_decode_data(s)
++    badchar = None
++    for b in b'+/':
++        if b in s:
++            badchar = b
++            break
+     s = s.translate(_urlsafe_decode_translation)
+-    return b64decode(s)
++    result = binascii.a2b_base64(s, strict_mode=False)
++    if badchar is not None:
++        import warnings
++        warnings.warn(f'invalid character {chr(badchar)!a} in URL-safe Base64 data '
++                      f'will be discarded in future Python versions',
++                      FutureWarning, stacklevel=2)
++    return result
+ 
+ 
+ 
+Index: Python-3.14.2/Lib/test/test_base64.py
+===================================================================
+--- Python-3.14.2.orig/Lib/test/test_base64.py	2026-02-03 18:10:43.960993003 +0100
++++ Python-3.14.2/Lib/test/test_base64.py	2026-02-03 18:10:52.116085599 +0100
+@@ -242,6 +242,25 @@
+             eq(base64.b64decode(data, altchars=altchars_str), res)
+             eq(base64.b64decode(data_str, altchars=altchars_str), res)
+ 
++    def test_b64decode_altchars(self):
++        # Test with arbitrary alternative characters
++        eq = self.assertEqual
++        res = b'\xd3V\xbeo\xf7\x1d'
++        for altchars in b'*$', b'+/', b'/+', b'+_', b'-+', b'-/', b'/_':
++            data = b'01a%cb%ccd' % tuple(altchars)
++            data_str = data.decode('ascii')
++            altchars_str = altchars.decode('ascii')
++
++            eq(base64.b64decode(data, altchars=altchars), res)
++            eq(base64.b64decode(data_str, altchars=altchars), res)
++            eq(base64.b64decode(data, altchars=altchars_str), res)
++            eq(base64.b64decode(data_str, altchars=altchars_str), res)
++
++        self.assertRaises(ValueError, base64.b64decode, b'', altchars=b'+')
++        self.assertRaises(ValueError, base64.b64decode, b'', altchars=b'+/-')
++        self.assertRaises(ValueError, base64.b64decode, '', altchars='+')
++        self.assertRaises(ValueError, base64.b64decode, '', altchars='+/-')
++
+     def test_b64decode_padding_error(self):
+         self.assertRaises(binascii.Error, base64.b64decode, b'abc')
+         self.assertRaises(binascii.Error, base64.b64decode, 'abc')
+@@ -273,13 +292,25 @@
+             with self.assertRaises(binascii.Error):
+                 base64.b64decode(bstr.decode('ascii'), validate=True)
+ 
+-        # Normal alphabet characters not discarded when alternative given
+-        res = b'\xfb\xef\xff'
+-        self.assertEqual(base64.b64decode(b'++//', validate=True), res)
+-        self.assertEqual(base64.b64decode(b'++//', '-_', validate=True), res)
+-        self.assertEqual(base64.b64decode(b'--__', '-_', validate=True), res)
+-        self.assertEqual(base64.urlsafe_b64decode(b'++//'), res)
+-        self.assertEqual(base64.urlsafe_b64decode(b'--__'), res)
++        # Normal alphabet characters will be discarded when alternative given
++        with self.assertWarns(FutureWarning):
++            self.assertEqual(base64.b64decode(b'++++', altchars=b'-_'),
++                             b'\xfb\xef\xbe')
++        with self.assertWarns(FutureWarning):
++            self.assertEqual(base64.b64decode(b'////', altchars=b'-_'),
++                             b'\xff\xff\xff')
++        with self.assertWarns(DeprecationWarning):
++            self.assertEqual(base64.b64decode(b'++++', altchars=b'-_', validate=True),
++                             b'\xfb\xef\xbe')
++        with self.assertWarns(DeprecationWarning):
++            self.assertEqual(base64.b64decode(b'////', altchars=b'-_', validate=True),
++                             b'\xff\xff\xff')
++        with self.assertWarns(FutureWarning):
++            self.assertEqual(base64.urlsafe_b64decode(b'++++'), b'\xfb\xef\xbe')
++        with self.assertWarns(FutureWarning):
++            self.assertEqual(base64.urlsafe_b64decode(b'////'), b'\xff\xff\xff')
++        with self.assertRaises(binascii.Error):
++            base64.b64decode(b'+/!', altchars=b'-_')
+ 
+     def test_b32encode(self):
+         eq = self.assertEqual
+Index: Python-3.14.2/Misc/NEWS.d/next/Library/2025-11-06-12-03-29.gh-issue-125346.7Gfpgw.rst
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ Python-3.14.2/Misc/NEWS.d/next/Library/2025-11-06-12-03-29.gh-issue-125346.7Gfpgw.rst	2026-02-03 18:10:52.116411403 +0100
+@@ -0,0 +1,5 @@
++Accepting ``+`` and ``/`` characters with an alternative alphabet in
++:func:`base64.b64decode` and :func:`base64.urlsafe_b64decode` is now
++deprecated.
++In future Python versions they will be errors in the strict mode and
++discarded in the non-strict mode.

CVE-2025-15282-urllib-ctrl-chars.patch

@@ -0,0 +1,59 @@
+From d8850aac54c234201966c66e83225564302cd15c Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Fri, 16 Jan 2026 10:54:09 -0600
+Subject: [PATCH 1/2] Add 'test.support' fixture for C0 control characters
+
+---
+ Lib/test/test_urllib.py                                                  |    8 ++++++++
+ Lib/urllib/request.py                                                    |    5 +++++
+ Misc/NEWS.d/next/Security/2026-01-16-11-51-19.gh-issue-143925.mrtcHW.rst |    1 +
+ 3 files changed, 14 insertions(+)
+
+Index: Python-3.14.2/Lib/test/test_urllib.py
+===================================================================
+--- Python-3.14.2.orig/Lib/test/test_urllib.py	2026-02-04 17:42:25.623976782 +0100
++++ Python-3.14.2/Lib/test/test_urllib.py	2026-02-04 17:42:28.218541497 +0100
+@@ -10,6 +10,7 @@
+ from test import support
+ from test.support import os_helper
+ from test.support import socket_helper
++from test.support import control_characters_c0
+ import os
+ import socket
+ try:
+@@ -590,6 +591,13 @@
+         # missing padding character
+         self.assertRaises(ValueError,urllib.request.urlopen,'data:;base64,Cg=')
+ 
++    def test_invalid_mediatype(self):
++        for c0 in control_characters_c0():
++            self.assertRaises(ValueError,urllib.request.urlopen,
++                              f'data:text/html;{c0},data')
++        for c0 in control_characters_c0():
++            self.assertRaises(ValueError,urllib.request.urlopen,
++                              f'data:text/html{c0};base64,ZGF0YQ==')
+ 
+ class urlretrieve_FileTests(unittest.TestCase):
+     """Test urllib.urlretrieve() on local files"""
+Index: Python-3.14.2/Lib/urllib/request.py
+===================================================================
+--- Python-3.14.2.orig/Lib/urllib/request.py	2026-02-04 17:42:25.957192912 +0100
++++ Python-3.14.2/Lib/urllib/request.py	2026-02-04 17:42:28.219479961 +0100
+@@ -1634,6 +1634,11 @@
+         scheme, data = url.split(":",1)
+         mediatype, data = data.split(",",1)
+ 
++        # Disallow control characters within mediatype.
++        if re.search(r"[\x00-\x1F\x7F]", mediatype):
++            raise ValueError(
++                "Control characters not allowed in data: mediatype")
++
+         # even base64 encoded data URLs might be quoted so unquote in any case:
+         data = unquote_to_bytes(data)
+         if mediatype.endswith(";base64"):
+Index: Python-3.14.2/Misc/NEWS.d/next/Security/2026-01-16-11-51-19.gh-issue-143925.mrtcHW.rst
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ Python-3.14.2/Misc/NEWS.d/next/Security/2026-01-16-11-51-19.gh-issue-143925.mrtcHW.rst	2026-02-04 17:42:28.219908231 +0100
+@@ -0,0 +1 @@
++Reject control characters in ``data:`` URL media types.

CVE-2025-15366-imap-ctrl-chars.patch

@@ -0,0 +1,56 @@
+From 7485ee5e2cf81d3e5ad0d9c3be73cecd2ab4eec7 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Fri, 16 Jan 2026 10:54:09 -0600
+Subject: [PATCH 1/2] Add 'test.support' fixture for C0 control characters
+
+---
+ Lib/imaplib.py                                                           |    4 +++-
+ Lib/test/test_imaplib.py                                                 |    6 ++++++
+ Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst |    1 +
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+
+Index: Python-3.14.2/Lib/imaplib.py
+===================================================================
+--- Python-3.14.2.orig/Lib/imaplib.py	2026-02-04 10:40:49.778522482 +0100
++++ Python-3.14.2/Lib/imaplib.py	2026-02-04 10:40:56.615206398 +0100
+@@ -131,7 +131,7 @@
+ # We compile these in _mode_xxx.
+ _Literal = br'.*{(?P<size>\d+)}$'
+ _Untagged_status = br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?'
+-
++_control_chars = re.compile(b'[\x00-\x1F\x7F]')
+ 
+ 
+ class IMAP4:
+@@ -1108,6 +1108,8 @@
+             if arg is None: continue
+             if isinstance(arg, str):
+                 arg = bytes(arg, self._encoding)
++            if _control_chars.search(arg):
++                raise ValueError("Control characters not allowed in commands")
+             data = data + b' ' + arg
+ 
+         literal = self.literal
+Index: Python-3.14.2/Lib/test/test_imaplib.py
+===================================================================
+--- Python-3.14.2.orig/Lib/test/test_imaplib.py	2026-02-04 10:40:51.056286261 +0100
++++ Python-3.14.2/Lib/test/test_imaplib.py	2026-02-04 10:40:56.615735521 +0100
+@@ -663,6 +663,12 @@
+         self.assertEqual(data[0], b'Returned to authenticated state. (Success)')
+         self.assertEqual(client.state, 'AUTH')
+ 
++    def test_control_characters(self):
++        client, _ = self._setup(SimpleIMAPHandler)
++        for c0 in support.control_characters_c0():
++            with self.assertRaises(ValueError):
++                client.login(f'user{c0}', 'pass')
++
+     # property tests
+ 
+     def test_file_property_should_not_be_accessed(self):
+Index: Python-3.14.2/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ Python-3.14.2/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst	2026-02-04 10:40:56.616133410 +0100
+@@ -0,0 +1 @@
++Reject control characters in IMAP commands.

CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch

@@ -0,0 +1,209 @@
+From 2bb0ca857e7d2593da6f6936187465a49a63c2d5 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Tue, 20 Jan 2026 15:23:42 -0600
+Subject: [PATCH] gh-143919: Reject control characters in http cookies (cherry
+ picked from commit 95746b3a13a985787ef53b977129041971ed7f70)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Co-authored-by: Seth Michael Larson <seth@python.org>
+Co-authored-by: Bartosz Sławecki <bartosz@ilikepython.com>
+Co-authored-by: sobolevn <mail@sobolevn.me>
+---
+ Doc/library/http.cookies.rst                                             |    4 
+ Lib/http/cookies.py                                                      |   25 ++++
+ Lib/test/support/__init__.py                                             |   10 +
+ Lib/test/test_http_cookies.py                                            |   52 +++++++++-
+ Misc/NEWS.d/next/Security/2026-01-16-11-13-15.gh-issue-143919.kchwZV.rst |    1 
+ 5 files changed, 82 insertions(+), 10 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-13-15.gh-issue-143919.kchwZV.rst
+
+Index: Python-3.14.2/Doc/library/http.cookies.rst
+===================================================================
+--- Python-3.14.2.orig/Doc/library/http.cookies.rst	2025-12-05 17:49:16.000000000 +0100
++++ Python-3.14.2/Doc/library/http.cookies.rst	2026-01-30 14:25:26.265077841 +0100
+@@ -292,9 +292,9 @@
+    Set-Cookie: chips=ahoy
+    Set-Cookie: vienna=finger
+    >>> C = cookies.SimpleCookie()
+-   >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=\\012;";')
++   >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=;";')
+    >>> print(C)
+-   Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=\012;"
++   Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=;"
+    >>> C = cookies.SimpleCookie()
+    >>> C["oreo"] = "doublestuff"
+    >>> C["oreo"]["path"] = "/"
+Index: Python-3.14.2/Lib/http/cookies.py
+===================================================================
+--- Python-3.14.2.orig/Lib/http/cookies.py	2026-01-30 14:25:21.316524119 +0100
++++ Python-3.14.2/Lib/http/cookies.py	2026-01-30 14:25:26.265560727 +0100
+@@ -87,9 +87,9 @@
+ such trickeries do not confuse it.
+ 
+    >>> C = cookies.SimpleCookie()
+-   >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=\\012;";')
++   >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=;";')
+    >>> print(C)
+-   Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=\012;"
++   Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=;"
+ 
+ Each element of the Cookie also supports all of the RFC 2109
+ Cookie attributes.  Here's an example which sets the Path
+@@ -170,6 +170,15 @@
+ })
+ 
+ _is_legal_key = re.compile('[%s]+' % re.escape(_LegalChars)).fullmatch
++_control_character_re = re.compile(r'[\x00-\x1F\x7F]')
++
++
++def _has_control_character(*val):
++    """Detects control characters within a value.
++    Supports any type, as header values can be any type.
++    """
++    return any(_control_character_re.search(str(v)) for v in val)
++
+ 
+ def _quote(str):
+     r"""Quote a string for use in a cookie header.
+@@ -294,12 +303,16 @@
+         K = K.lower()
+         if not K in self._reserved:
+             raise CookieError("Invalid attribute %r" % (K,))
++        if _has_control_character(K, V):
++            raise CookieError(f"Control characters are not allowed in cookies {K!r} {V!r}")
+         dict.__setitem__(self, K, V)
+ 
+     def setdefault(self, key, val=None):
+         key = key.lower()
+         if key not in self._reserved:
+             raise CookieError("Invalid attribute %r" % (key,))
++        if _has_control_character(key, val):
++            raise CookieError("Control characters are not allowed in cookies %r %r" % (key, val,))
+         return dict.setdefault(self, key, val)
+ 
+     def __eq__(self, morsel):
+@@ -335,6 +348,9 @@
+             raise CookieError('Attempt to set a reserved key %r' % (key,))
+         if not _is_legal_key(key):
+             raise CookieError('Illegal key %r' % (key,))
++        if _has_control_character(key, val, coded_val):
++            raise CookieError(
++                "Control characters are not allowed in cookies %r %r %r" % (key, val, coded_val,))
+ 
+         # It's a good key, so save it.
+         self._key = key
+@@ -488,7 +504,10 @@
+         result = []
+         items = sorted(self.items())
+         for key, value in items:
+-            result.append(value.output(attrs, header))
++            value_output = value.output(attrs, header)
++            if _has_control_character(value_output):
++                raise CookieError("Control characters are not allowed in cookies")
++            result.append(value_output)
+         return sep.join(result)
+ 
+     __str__ = output
+Index: Python-3.14.2/Lib/test/support/__init__.py
+===================================================================
+--- Python-3.14.2.orig/Lib/test/support/__init__.py	2026-01-30 14:25:22.035209804 +0100
++++ Python-3.14.2/Lib/test/support/__init__.py	2026-01-30 14:26:31.354376277 +0100
+@@ -68,7 +68,8 @@
+     "BrokenIter",
+     "in_systemd_nspawn_sync_suppressed",
+     "run_no_yield_async_fn", "run_yielding_async_fn", "async_yield",
+-    "reset_code", "on_github_actions"
++    "reset_code", "on_github_actions",
++    "control_characters_c0",
+     ]
+ 
+ 
+@@ -3185,3 +3186,10 @@
+         return _linked_to_musl
+     _linked_to_musl = tuple(map(int, version.split('.')))
+     return _linked_to_musl
++
++
++def control_characters_c0() -> list[str]:
++    """Returns a list of C0 control characters as strings.
++    C0 control characters defined as the byte range 0x00-0x1F, and 0x7F.
++    """
++    return [chr(c) for c in range(0x00, 0x20)] + ["\x7F"]
+Index: Python-3.14.2/Lib/test/test_http_cookies.py
+===================================================================
+--- Python-3.14.2.orig/Lib/test/test_http_cookies.py	2026-01-30 14:25:22.919203244 +0100
++++ Python-3.14.2/Lib/test/test_http_cookies.py	2026-01-30 14:25:26.265943668 +0100
+@@ -17,10 +17,10 @@
+              'repr': "<SimpleCookie: chips='ahoy' vienna='finger'>",
+              'output': 'Set-Cookie: chips=ahoy\nSet-Cookie: vienna=finger'},
+ 
+-            {'data': 'keebler="E=mc2; L=\\"Loves\\"; fudge=\\012;"',
+-             'dict': {'keebler' : 'E=mc2; L="Loves"; fudge=\012;'},
+-             'repr': '''<SimpleCookie: keebler='E=mc2; L="Loves"; fudge=\\n;'>''',
+-             'output': 'Set-Cookie: keebler="E=mc2; L=\\"Loves\\"; fudge=\\012;"'},
++            {'data': 'keebler="E=mc2; L=\\"Loves\\"; fudge=;"',
++             'dict': {'keebler' : 'E=mc2; L="Loves"; fudge=;'},
++             'repr': '''<SimpleCookie: keebler='E=mc2; L="Loves"; fudge=;'>''',
++             'output': 'Set-Cookie: keebler="E=mc2; L=\\"Loves\\"; fudge=;"'},
+ 
+             # Check illegal cookies that have an '=' char in an unquoted value
+             {'data': 'keebler=E=mc2',
+@@ -571,6 +571,50 @@
+                 r'Set-Cookie: key=coded_val; '
+                 r'expires=\w+, \d+ \w+ \d+ \d+:\d+:\d+ \w+')
+ 
++    def test_control_characters(self):
++        for c0 in support.control_characters_c0():
++            morsel = cookies.Morsel()
++
++            # .__setitem__()
++            with self.assertRaises(cookies.CookieError):
++                morsel[c0] = "val"
++            with self.assertRaises(cookies.CookieError):
++                morsel["path"] = c0
++
++            # .setdefault()
++            with self.assertRaises(cookies.CookieError):
++                morsel.setdefault("path", c0)
++            with self.assertRaises(cookies.CookieError):
++                morsel.setdefault(c0, "val")
++
++            # .set()
++            with self.assertRaises(cookies.CookieError):
++                morsel.set(c0, "val", "coded-value")
++            with self.assertRaises(cookies.CookieError):
++                morsel.set("path", c0, "coded-value")
++            with self.assertRaises(cookies.CookieError):
++                morsel.set("path", "val", c0)
++
++    def test_control_characters_output(self):
++        # Tests that even if the internals of Morsel are modified
++        # that a call to .output() has control character safeguards.
++        for c0 in support.control_characters_c0():
++            morsel = cookies.Morsel()
++            morsel.set("key", "value", "coded-value")
++            morsel._key = c0  # Override private variable.
++            cookie = cookies.SimpleCookie()
++            cookie["cookie"] = morsel
++            with self.assertRaises(cookies.CookieError):
++                cookie.output()
++
++            morsel = cookies.Morsel()
++            morsel.set("key", "value", "coded-value")
++            morsel._coded_value = c0  # Override private variable.
++            cookie = cookies.SimpleCookie()
++            cookie["cookie"] = morsel
++            with self.assertRaises(cookies.CookieError):
++                cookie.output()
++
+ 
+ def load_tests(loader, tests, pattern):
+     tests.addTest(doctest.DocTestSuite(cookies))
+Index: Python-3.14.2/Misc/NEWS.d/next/Security/2026-01-16-11-13-15.gh-issue-143919.kchwZV.rst
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ Python-3.14.2/Misc/NEWS.d/next/Security/2026-01-16-11-13-15.gh-issue-143919.kchwZV.rst	2026-01-30 14:25:26.266224501 +0100
+@@ -0,0 +1 @@
++Reject control characters in :class:`http.cookies.Morsel` fields and values.

CVE-2026-0865-wsgiref-hdrs-EOLs.patch

@@ -0,0 +1,68 @@
+From e7f180b4c21576f52c08933a184d84dc4b47e00e Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Fri, 16 Jan 2026 10:54:09 -0600
+Subject: [PATCH 1/2] Add 'test.support' fixture for C0 control characters
+
+---
+ Lib/test/test_wsgiref.py                                                 |   12 +++++++++-
+ Lib/wsgiref/headers.py                                                   |    3 ++
+ Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst |    2 +
+ 3 files changed, 16 insertions(+), 1 deletion(-)
+
+Index: Python-3.14.2/Lib/test/test_wsgiref.py
+===================================================================
+--- Python-3.14.2.orig/Lib/test/test_wsgiref.py	2026-02-04 09:48:18.748809337 +0100
++++ Python-3.14.2/Lib/test/test_wsgiref.py	2026-02-04 09:48:33.549108531 +0100
+@@ -1,6 +1,6 @@
+ from unittest import mock
+ from test import support
+-from test.support import socket_helper
++from test.support import socket_helper, control_characters_c0
+ from test.test_httpservers import NoLogRequestHandler
+ from unittest import TestCase
+ from wsgiref.util import setup_testing_defaults
+@@ -503,6 +503,16 @@
+             '\r\n'
+         )
+ 
++    def testRaisesControlCharacters(self):
++        headers = Headers()
++        for c0 in control_characters_c0():
++            self.assertRaises(ValueError, headers.__setitem__, f"key{c0}", "val")
++            self.assertRaises(ValueError, headers.__setitem__, "key", f"val{c0}")
++            self.assertRaises(ValueError, headers.add_header, f"key{c0}", "val", param="param")
++            self.assertRaises(ValueError, headers.add_header, "key", f"val{c0}", param="param")
++            self.assertRaises(ValueError, headers.add_header, "key", "val", param=f"param{c0}")
++
++
+ class ErrorHandler(BaseCGIHandler):
+     """Simple handler subclass for testing BaseHandler"""
+ 
+Index: Python-3.14.2/Lib/wsgiref/headers.py
+===================================================================
+--- Python-3.14.2.orig/Lib/wsgiref/headers.py	2026-02-04 09:48:19.030042448 +0100
++++ Python-3.14.2/Lib/wsgiref/headers.py	2026-02-04 09:48:33.549531075 +0100
+@@ -9,6 +9,7 @@
+ # existence of which force quoting of the parameter value.
+ import re
+ tspecials = re.compile(r'[ \(\)<>@,;:\\"/\[\]\?=]')
++_control_chars_re = re.compile(r'[\x00-\x1F\x7F]')
+ 
+ def _formatparam(param, value=None, quote=1):
+     """Convenience function to format and return a key=value pair.
+@@ -41,6 +42,8 @@
+     def _convert_string_type(self, value):
+         """Convert/check value type."""
+         if type(value) is str:
++            if _control_chars_re.search(value):
++                raise ValueError("Control characters not allowed in headers")
+             return value
+         raise AssertionError("Header names/values must be"
+             " of type str (got {0})".format(repr(value)))
+Index: Python-3.14.2/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ Python-3.14.2/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst	2026-02-04 09:48:33.549806881 +0100
+@@ -0,0 +1,2 @@
++Reject C0 control characters within wsgiref.headers.Headers fields, values,
++and parameters.

python314.changes

@@ -1,3 +1,21 @@
+-------------------------------------------------------------------
+Wed Feb  4 00:53:37 UTC 2026 - Matej Cepl <mcepl@cepl.eu>
+
+- Add CVE-2025-12781-b64decode-alt-chars.patch fixing bsc#1257108
+  (CVE-2025-12781) combining gh#python/cpython!141061,
+  gh#python/cpython!141128, and gh#python/cpython!141153. All
+  `*b64decode` functions should not accept non-altchars.
+- Add CVE-2026-0865-wsgiref-hdrs-EOLs.patch fixing bsc#1257042
+  (CVE-2026-0865) rejecting control characters in
+  wsgiref.headers.Headers, which could be abused for injecting
+  false HTTP headers.
+- Add CVE-2025-15366-imap-ctrl-chars.patch fixing bsc#1257044
+  (CVE-2025-15366) using gh#python/cpython!143922 and doing
+  basically the same as the previous patch for IMAP protocol.
+- Add CVE-2025-15282-urllib-ctrl-chars.patch fixing bsc#1257046
+  (CVE-2025-15282) using gh#python/cpython!143926 and doing
+  basically the same as the previous patch for urllib library.
+
 -------------------------------------------------------------------
 Thu Jan 29 12:58:15 UTC 2026 - Matej Cepl <mcepl@cepl.eu>
 
@@ -7,6 +25,9 @@ Thu Jan 29 12:58:15 UTC 2026 - Matej Cepl <mcepl@cepl.eu>
 - Add CVE-2025-11468-email-hdr-fold-comment.patch preserving
   parens when folding comments in email headers (bsc#1257029,
   CVE-2025-11468).
+- Add CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch, which
+  rejects control characters in http cookies (bsc#1257031,
+  CVE-2026-0672).
 
 -------------------------------------------------------------------
 Thu Dec 11 17:37:09 UTC 2025 - Matej Cepl <mcepl@cepl.eu>

python314.spec

@@ -231,6 +231,21 @@ Patch46:        CVE-2024-6923-follow-up-EOL-email-headers.patch
 # PATCH-FIX-UPSTREAM CVE-2025-11468-email-hdr-fold-comment.patch bsc#1257029 mcepl@suse.com
 # Email preserve parens when folding comments
 Patch47:        CVE-2025-11468-email-hdr-fold-comment.patch
+# PATCH-FIX-UPSTREAM CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch bsc#1257031 mcepl@suse.com
+# Reject control characters in http cookies
+Patch48:        CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
+# PATCH-FIX-UPSTREAM CVE-2025-12781-b64decode-alt-chars.patch bsc#1257108 mcepl@suse.com
+# Fix decoding with non-standard Base64 alphabet gh#python/cpython#125346
+Patch49:        CVE-2025-12781-b64decode-alt-chars.patch
+# PATCH-FIX-UPSTREAM CVE-2026-0865-wsgiref-hdrs-EOLs.patch bsc#1257042 mcepl@suse.com
+# Reject control characters in wsgiref.headers.Headers
+Patch50:        CVE-2026-0865-wsgiref-hdrs-EOLs.patch
+# PATCH-FIX-UPSTREAM CVE-2025-15366-imap-ctrl-chars.patch bsc#1257044 mcepl@suse.com
+# Reject control characters in wsgiref.headers.Headers
+Patch51:        CVE-2025-15366-imap-ctrl-chars.patch
+# PATCH-FIX-UPSTREAM CVE-2025-15282-urllib-ctrl-chars.patch bsc#1257046 mcepl@suse.com
+# Reject control characters in wsgiref.headers.Headers
+Patch52:        CVE-2025-15282-urllib-ctrl-chars.patch
 #### Python 3.14 END OF PATCHES
 BuildRequires:  autoconf-archive
 BuildRequires:  automake