Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-36276.51E-DA.rst

Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request.  Such potentially malicious header injection URLs now cause a ValueError to be raised.