From 9525cd8848d0015f5a03b581842f4efd3333a9ab Mon Sep 17 00:00:00 2001 From: Andrew Dang Date: Sat, 27 Jun 2026 02:06:31 -0500 Subject: [PATCH] Reject NUL bytes in HTTP request lines Reject request lines containing NUL bytes before parsing the request target and protocol. This keeps malformed request-line handling consistent with the existing bad request path and covers the case in the malformed request-line test matrix. --- cheroot/server.py | 7 +++++++ cheroot/test/test_core.py | 5 +++++ docs/changelog-fragments.d/832.bugfix.rst | 1 + 3 files changed, 13 insertions(+) create mode 100644 docs/changelog-fragments.d/832.bugfix.rst diff --git a/cheroot/server.py b/cheroot/server.py index 284cf17c72..92652d1b24 100644 --- a/cheroot/server.py +++ b/cheroot/server.py @@ -800,6 +800,13 @@ def read_request_line(self): # noqa: C901 # FIXME ) return False + if b'\x00' in request_line: + self.simple_response( + '400 Bad Request', + 'Malformed Request-Line', + ) + return False + try: method, uri, req_protocol = request_line.strip().split(SPACE, 2) if not req_protocol.startswith(b'HTTP/'): diff --git a/cheroot/test/test_core.py b/cheroot/test/test_core.py index cd3841d428..b0e039720c 100644 --- a/cheroot/test/test_core.py +++ b/cheroot/test/test_core.py @@ -314,6 +314,11 @@ def test_large_request(test_client_with_defaults): HTTP_BAD_REQUEST, b'Malformed Request-Line', ), + ( + b'GET /\x00 HTTP/1.1', # NUL byte + HTTP_BAD_REQUEST, + b'Malformed Request-Line', + ), ( b'GET / HTTPS/1.1', # invalid proto HTTP_BAD_REQUEST, diff --git a/docs/changelog-fragments.d/832.bugfix.rst b/docs/changelog-fragments.d/832.bugfix.rst new file mode 100644 index 0000000000..c554cbfba3 --- /dev/null +++ b/docs/changelog-fragments.d/832.bugfix.rst @@ -0,0 +1 @@ +Rejected HTTP request lines containing NUL bytes as malformed requests.