CVE-2026-0672
MediumCVSS 6.0Summary
In http.cookies.Morsel (Python), user-controlled cookie values and parameters can allow injecting HTTP headers into messages. The patch rejects all control characters within cookie names, values, and parameters.
Risk Assessment
An attacker could inject arbitrary HTTP headers, potentially leading to response splitting, cache poisoning, or other attacks. This could compromise the security of web applications using this module.
Recommendation
Update Python to a version containing the fix (latest security release). Ensure that cookie inputs are properly validated and sanitized.
Other vulnerabilities in Python http.cookies
See all- CVE-2026-6019Medium
The http.cookies.Morsel.js_output() function returns an inline <script> snippet and does not neutralize the </script> sequence, allowing HTML injection. Mitigation base64-encodes the cookie value.
- CVE-2026-3644High
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Original NVD description (English source)
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS