This vulnerability in CPython occurs because CR/LF bytes were not rejected in HTTP client proxy tunnel headers or host fields, potentially allowing injection of unexpected HTTP headers or manipulation of HTTP requests. It is categorized under CWE-93, which concerns improper neutralization of CRLF sequences. The affected versions explicitly include 3.11.0, 3.12.0, 3.13.0, 3.14.0a1, and 3.15.0a1. The CVSS 4.0 base score is 5.7, indicating medium severity, with network attack vector, low attack complexity, partial privileges required, and partial user interaction. No vendor advisory or patch is currently available, and no known exploits have been reported.

The vulnerability could allow an attacker with partial privileges and user interaction to manipulate HTTP headers in proxy tunnel requests by injecting CR/LF sequences. This may lead to HTTP header injection or related issues, but no direct impact such as code execution or privilege escalation is indicated. The medium CVSS score reflects moderate risk.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is released, users should be cautious when handling HTTP proxy tunnel headers in affected CPython versions and consider applying any recommended workarounds from the vendor once available.