diff --git a/Network/Wai/Handler/Warp/Request.hs b/Network/Wai/Handler/Warp/Request.hs
--- a/Network/Wai/Handler/Warp/Request.hs
+++ b/Network/Wai/Handler/Warp/Request.hs
@@ -160,7 +160,11 @@
         -- if so, see if the second of those is a horizontal space
         if bsLen > nl + 1 then
             let c = S.index bs (nl + 1)
-            in Just (nl, c == 32 || c == 9)
+                b = case nl of
+                      0 -> True
+                      1 -> S.index bs 0 == 13
+                      _ -> False
+            in Just (nl, (not b) && (c == 32 || c == 9))
             else
             Just (nl, False)
 
diff --git a/Network/Wai/Handler/Warp/Run.hs b/Network/Wai/Handler/Warp/Run.hs
--- a/Network/Wai/Handler/Warp/Run.hs
+++ b/Network/Wai/Handler/Warp/Run.hs
@@ -33,6 +33,9 @@
 #if WINDOWS
 import qualified Control.Concurrent.MVar as MV
 import Network.Socket (withSocketsDo)
+#else
+import System.Posix.IO (FdOption(CloseOnExec), setFdOption)
+import Network.Socket (fdSocket)
 #endif
 
 #if SENDFILEFD
@@ -90,11 +93,13 @@
             runSettingsSocket set s app)
     forever (threadDelay maxBound) `finally` clean
 #else
-runSettings set =
+runSettings set app =
     bracket
         (bindPort (settingsPort set) (settingsHost set))
-        sClose .
-        flip (runSettingsSocket set)
+        sClose
+        (\socket -> do
+            setSocketCloseOnExec socket
+            runSettingsSocket set socket app)
 #endif
 
 -- | Same as 'runSettings', but uses a user-supplied socket instead of opening
@@ -109,6 +114,7 @@
   where
     getter = do
         (conn, sa) <- accept socket
+        setSocketCloseOnExec socket
         return (socketConnection conn, sa)
 
 runSettingsConnection :: Settings -> IO (Connection, SockAddr) -> Application -> IO ()
@@ -210,3 +216,12 @@
             when (S.length bs >= 2048) $ liftIO $ T.tickle th
             yield bs
             src
+
+-- Copied from: https://github.com/mzero/plush/blob/master/src/Plush/Server/Warp.hs
+setSocketCloseOnExec :: Socket -> IO ()
+#if WINDOWS
+setSocketCloseOnExec _ = return ()
+#else
+setSocketCloseOnExec socket =
+    setFdOption (fromIntegral $ fdSocket socket) CloseOnExec True
+#endif
diff --git a/warp.cabal b/warp.cabal
--- a/warp.cabal
+++ b/warp.cabal
@@ -1,5 +1,5 @@
 Name:                warp
-Version:             1.3.6
+Version:             1.3.7
 Synopsis:            A fast, light-weight web server for WAI applications.
 License:             MIT
 License-file:        LICENSE
@@ -10,7 +10,12 @@
 Build-Type:          Simple
 Cabal-Version:       >=1.8
 Stability:           Stable
-Description:         The premier WAI handler. For more information, see <http://steve.vinoski.net/blog/2011/05/01/warp-a-haskell-web-server/>.
+Description:
+    The premier WAI handler. For more information, see <http://steve.vinoski.net/blog/2011/05/01/warp-a-haskell-web-server/>.
+    .
+    Changelog
+    .
+    [1.3.7] Sockets now have FD_CLOEXEC set on them. This behavior is more secure, and the change should not affect the vast majority of use cases.
 
 Flag network-bytestring
     Default: False