CVE-2026-3644
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Risk Assessment
The organization is exposed to attacks involving injection of control characters into HTTP cookies, which can lead to session manipulation, account takeover, or other web application security breaches.
Recommendation
Immediately update the Python library to a version containing the full fix for CVE-2026-3644 and ensure that all cookie processing paths (including update, |=, and unpickling) are properly secured.
Other vulnerabilities in Python http.cookies
See all- CVE-2026-0672Medium
In http.cookies.Morsel (Python), user-controlled cookie values and parameters can allow injecting HTTP headers into messages. The patch rejects all control characters within cookie names, values, and parameters.
- CVE-2026-6019Medium
The http.cookies.Morsel.js_output() function returns an inline <script> snippet and does not neutralize the </script> sequence, allowing HTML injection. Mitigation base64-encodes the cookie value.
Original NVD description (English source)
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Vulnerability data from NVD (NIST) · CISA KEV · EPSS