Python: lenient integer parsing misreads HTTP response body and chunk framing

Python's HTTP response body and chunked-transfer parsing accepts non-hex or negative integers where it should reject them. An attacker controlling a response could make the parser misinterpret where a body or chunk ends, which can desync the response contents.

Summary written from the sources below. Check the originals before acting.