CVE-2026-3644
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Risk Assessment
The organization is exposed to attacks involving injection of control characters into HTTP cookies, which can lead to session manipulation, account takeover, or other web application security breaches.
Recommendation
Immediately update the Python library to a version containing the full fix for CVE-2026-3644 and ensure that all cookie processing paths (including update, |=, and unpickling) are properly secured.
Other vulnerabilities in Python http.cookies
Original NVD description (English source)
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().