Python http.cookies vulnerabilities

In http.cookies.Morsel (Python), user-controlled cookie values and parameters can allow injecting HTTP headers into messages. The patch rejects all control characters within cookie names, values, and parameters.

The http.cookies.Morsel.js_output() function returns an inline <script> snippet and does not neutralize the </script> sequence, allowing HTML injection. Mitigation base64-encodes the cookie value.

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().