CPython EUVD-2026-111382

Requires an application that uses Python's http.client (directly or via libraries built on it) to parse HTTP responses, AND a message path where a strict RFC 9112 peer (e.g., a proxy or cache) frames the same Content-Length or chunk-size differently than CPython does. Concretely, the trigger is a response whose Content-Length matches int() but not 1*DIGIT (e.g., '+5', '5_0') or whose chunked chunk-size matches int(_,16) but not 1*HEXDIG (e.g., '-5', '+5', '0x5', '1_f', ' 5'), as enumerated in the fix's regression tests. Limiting factors that reduce real-world risk: the flaw only manifests as a framing discrepancy when such a strict intermediary exists and the attacker can inject the malformed header/size; impact is confined to misinterpreting HTTP response content (CWE-444), with no confidentiality or availability impact and only low integrity effect; the CVSS 4.0 vector further requires PR:H, passive user interaction (UI:P) and a present attack requirement (AT:P).

This is a low-priority issue across every available signal, and the signals are consistent rather than conflicting. The only quantitative score supplied is a CVSS 4.0 base of 2.0 (vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N) - note this is a 4.0 vector, not 3.1, and its only non-zero impact is subsequent-system integrity (SI:L), with high privileges (PR:H), passive user interaction (UI:P) and a specific attack requirement (AT:P) all suppressing the score. The vuln.today Decision label is 'monitor', which aligns with the low CVSS. No EPSS probability was provided and the record is not on CISA KEV, so there is no public-exploitation telemetry: exploitation status is 'no public exploit identified at time of analysis' (the supplied references are the fix issue, PR and commits plus regression tests, not working exploit code). CWE-444 (HTTP request/response smuggling) can be serious in the right topology, but here the impact is bounded to misframing of HTTP message boundaries, not code execution or disclosure of memory. Net: a genuinely low-severity, conditional interoperability/smuggling defect best handled in a normal patch cycle, not an emergency. Missing data to flag explicitly: no EPSS score and no KEV entry are present in the input (absence, not a contradiction), so real-world exploitation likelihood is inferred only from the low CVSS and 'monitor' label.

An attacker able to control or influence HTTP responses reaching a Python application (a malicious/compromised upstream server or an on-path position) returns a Content-Length such as '+5' or '5_0', or a chunk-size such as '-5', '+5', '0x5', '1_f' or ' 5' that Python's int()/int(_,16) accepts but RFC 9112's strict grammar forbids. Because http.client would frame the body from that permissive value while a strict intermediary (proxy/cache) frames it differently, message boundaries desynchronize, letting the attacker smuggle or cause misinterpretation of response content. No public exploit code is available - only the upstream fix, regression tests and advisory references are published.