diff --git a/tests/requests/invalid/rfc9110_field_value_ctl_bel_01.http b/tests/requests/invalid/rfc9110_field_value_ctl_bel_01.http
new file mode 100644
index 00000000..de9cee5e
--- /dev/null
+++ b/tests/requests/invalid/rfc9110_field_value_ctl_bel_01.http
@@ -0,0 +1,4 @@
+GET /foo HTTP/1.1\r\n
+Host: example.com\r\n
+X-Value: plain\x07injected\r\n
+\r\n
diff --git a/tests/requests/invalid/rfc9110_field_value_ctl_bel_01.py b/tests/requests/invalid/rfc9110_field_value_ctl_bel_01.py
new file mode 100644
index 00000000..4203cfe9
--- /dev/null
+++ b/tests/requests/invalid/rfc9110_field_value_ctl_bel_01.py
@@ -0,0 +1,10 @@
+#
+# This file is part of gunicorn released under the MIT license.
+# See the NOTICE for more information.
+
+# RFC 9110 section 5.5: field-value characters are field-vchar (VCHAR +
+# obs-text) plus SP/HTAB. Control characters other than HTAB must not
+# appear, to prevent log/response injection and parser confusion.
+from gunicorn.http.errors import InvalidHeader
+request = InvalidHeader
+python_only = True
diff --git a/tests/requests/invalid/rfc9110_field_value_ctl_del_01.http b/tests/requests/invalid/rfc9110_field_value_ctl_del_01.http
new file mode 100644
index 00000000..88760579
--- /dev/null
+++ b/tests/requests/invalid/rfc9110_field_value_ctl_del_01.http
@@ -0,0 +1,4 @@
+GET /foo HTTP/1.1\r\n
+Host: example.com\r\n
+X-Value: plain\x7finjected\r\n
+\r\n
diff --git a/tests/requests/invalid/rfc9110_field_value_ctl_del_01.py b/tests/requests/invalid/rfc9110_field_value_ctl_del_01.py
new file mode 100644
index 00000000..cd6cd1aa
--- /dev/null
+++ b/tests/requests/invalid/rfc9110_field_value_ctl_del_01.py
@@ -0,0 +1,9 @@
+#
+# This file is part of gunicorn released under the MIT license.
+# See the NOTICE for more information.
+
+# RFC 9110 section 5.5: DEL (0x7F) is a control character and not a VCHAR;
+# it must not appear in a field-value.
+from gunicorn.http.errors import InvalidHeader
+request = InvalidHeader
+python_only = True