High 7.5Published Mar 16, 2026

CVE-2026-3644The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete.

Updated under an hour ago (2026-10-19 07:23 UTC)

Does this affect you?

It affects python. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for python

Exploited in the last 30 days

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

CVSS: 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness (CWE): CWE-20, CWE-116
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Aug 13, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

python python python:python	before 3.13.13; from 3.14.0 before 3.14.4; 3.15.0; 3.15.0; 3.15.0; 3.15.0; 3.15.0; 3.15.0; and 1 more ranges	NVD

References

https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330
https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8
https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4patch
https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590ddpatch
https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979ddpatch
https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef
https://github.com/python/cpython/issues/145599issue-tracking
https://github.com/python/cpython/pull/145600patch
https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.