diff --git a/Lib/http/client.py b/Lib/http/client.py
@@ -858,6 +858,8 @@ def __init__(self, host, port=None, timeout=socket._GLOBAL_DEFAULT_TIMEOUT,

        (self.host, self.port) = self._get_hostport(host, port)

        # This is stored as an instance variable to allow unit
        # tests to replace it with a suitable mockup
        self._create_connection = socket.create_connection
@@ -1215,6 +1217,14 @@ def _validate_path(self, url):
            raise InvalidURL(f"URL can't contain control characters. {url!r} "
                             f"(found at least {match.group()!r})")

    def putheader(self, header, *values):
        """Send a request header line to the server.


diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
@@ -1132,7 +1132,7 @@ def run_server():
        thread.join()
        self.assertEqual(result, b"proxied data\n")

-    def test_putrequest_override_validation(self):
        """
        It should be possible to override the default validation
        behavior in putrequest (bpo-38216).
@@ -1145,6 +1145,17 @@ def _validate_path(self, url):
        conn.sock = FakeSocket('')
        conn.putrequest('GET', '/\x00')

    def test_putrequest_override_encoding(self):
        """
        It should be possible to override the default encoding

diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
@@ -331,7 +331,7 @@ def test_willclose(self):
            self.unfakehttp()

    @unittest.skipUnless(ssl, "ssl module required")
-    def test_url_with_control_char_rejected(self):
        for char_no in list(range(0, 0x21)) + [0x7f]:
            char = chr(char_no)
            schemeless_url = f"//localhost:7777/test{char}/"
@@ -358,7 +358,7 @@ def test_url_with_control_char_rejected(self):
                self.unfakehttp()

    @unittest.skipUnless(ssl, "ssl module required")
-    def test_url_with_newline_header_injection_rejected(self):
        self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
        host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123"
        schemeless_url = "//" + host + ":8080/test/?test=a"
@@ -383,6 +383,38 @@ def test_url_with_newline_header_injection_rejected(self):
        finally:
            self.unfakehttp()

    def test_read_0_9(self):
        # "0.9" response accepted (but not "simple responses" without
        # a status line)

diff --git a/Misc/NEWS.d/next/Security/2020-03-14-14-57-44.bpo-38576.OowwQn.rst b/Misc/NEWS.d/next/Security/2020-03-14-14-57-44.bpo-38576.OowwQn.rst
@@ -0,0 +1 @@