OpenSSL Machine 4c62468c95 Reject CR/LF in HTTP request components ...

Reject CR and LF characters before serializing request lines and HTTP
headers. This prevents malformed URL or caller supplied components
from altering the generated HTTP request.

Resolves: https://github.com/openssl/openssl/issues/31099

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Mon May 11 07:44:19 2026
(Merged from https://github.com/openssl/openssl/pull/31100)

2026-05-11 09:42:58 +02:00

..

build.info

x509: allow SAN URIs to contain userinfo

2025-03-04 17:30:34 +01:00

http_client.c

Reject CR/LF in HTTP request components

2026-05-11 09:42:58 +02:00

http_err.c

OSSL_HTTP_REQ_CTX_nbio(): check for clear Content-Type mismatch

2026-03-05 19:04:13 +01:00

http_lib.c

Add check for empty server host in http_lib.c

2026-04-29 17:25:22 +02:00