{"id":"CVE-2026-103995","kind":"vulnerability","aliases":["CVE-2026-103995"],"related":[],"title":"Python: lenient integer parsing misreads HTTP response body and chunk framing","description":"Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.","summary":"Python's HTTP response body and chunked-transfer parsing accepts non-hex or negative integers where it should reject them. An attacker controlling a response could make the parser misinterpret where a body or chunk ends, which can desync the response contents.","severity":"low","cvss":2.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-clients","python","runtime"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T20:17:11+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","triaged_at":"2026-10-27T20:35:36+00:00","updated_at":"2026-10-27T20:35:36+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T20:35:36Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Python: lenient integer parsing misreads HTTP response body and chunk framing","impact":"low","summary":"Python's HTTP response body and chunked-transfer parsing accepts non-hex or negative integers where it should reject them. An attacker controlling a response could make the parser misinterpret where a body or chunk ends, which can desync the response contents.","category":"runtime","nicknames":[],"who_cares":["python","http-clients"],"confidence":0.5,"needs_auth":"unknown","worst_case":"HTTP response contents misread, possibly enabling request smuggling","analyst_note":"Find the affected Python versions and fixed releases in the linked python-announce post and the NVD entry; the sources give no version list.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000501,"input_tokens":3303,"output_tokens":341,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-103995':14A,17A '-2026':13A,16A 'accept':33B 'attack':46B 'bodi':8A,27B,57B,68C 'chunk':10A,30B,59B,70C 'chunked-transf':29B 'client':20B 'content':66B,88C 'control':47B 'could':50B,82C 'cve':12A,15A 'desync':63B 'end':60B 'frame':11A 'handl':73C 'hex':36B,76C 'http':6A,19B,25B,86C 'http-client':18B 'incorrect':80C 'integ':3A,39B,79C 'lenient':2A 'make':51B 'misinterpret':54B,85C 'misread':5A 'negat':38B,78C 'non':35B,75C 'non-hex':34B,74C 'pars':4A,32B,71C 'parser':53B 'python':1A,21B,23B 'reject':43B 'respons':7A,26B,49B,65B,67C,87C 'result':83C 'runtim':22B 'transfer':31B 'would':72C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T19:26:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@python.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103995","severity":null,"published_at":"2026-10-27T20:17:11+00:00","modified_at":"2026-10-27T20:17:11+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","fetched_at":"2026-10-27T20:33:27+00:00","note":null}],"documents":[{"id":7572,"url":"https://mail.python.org/archives/list/security-announce@python.org/message/6TLH7YBU4HJIFBTBCEPAAK2I2F4KQBRB/","title":"Python security-announce: [Security-announce][CVE-2026-103995] Lenient parsing of integers for response body and chunk framing","kind":"advisory","source":"advisory","text":"[Security-announce][CVE-2026-103995] Lenient parsing of integers for response body and chunk framing\n\nThere is a LOW severity vulnerability affecting CPython. Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-103995 * https://github.com/python/cpython/pull/150752","published_at":"2026-10-27T19:26:24+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}