CVE-2024-7592
published 2024-08-19CVE-2024-7592: There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.30%
81.3th percentile
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module.
When parsing cookies that contained backslashes for quoted characters in
the cookie value, the parser would use an algorithm with quadratic
complexity, resulting in excess CPU resources being used while parsing the
value.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pypy3 | < pypy3 7.3.5+dfsg-2+deb11u5 (bullseye) | pypy3 7.3.5+dfsg-2+deb11u5 (bullseye) |
| debian | python3.11 | < pypy3 7.3.5+dfsg-2+deb11u5 (bullseye) | pypy3 7.3.5+dfsg-2+deb11u5 (bullseye) |
| debian | python3.13 | < pypy3 7.3.5+dfsg-2+deb11u5 (bullseye) | pypy3 7.3.5+dfsg-2+deb11u5 (bullseye) |
| debian | python3.9 | < pypy3 7.3.5+dfsg-2+deb11u5 (bullseye) | pypy3 7.3.5+dfsg-2+deb11u5 (bullseye) |
| msrc | azl3_python3_3.12.3-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_python3_3.12.3-5_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-6_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_python3_3.9.19-13_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.19-4_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| python | python | < 3.8.20 | 3.8.20 |
| python | python | — | — |
| python | python | >= 3.10.0 < 3.10.15 | 3.10.15 |
| python | python | >= 3.11.0 < 3.11.10 | 3.11.10 |
| python | python | >= 3.12.0 < 3.12.6 | 3.12.6 |
| python | python | >= 3.9.0 < 3.9.20 | 3.9.20 |
| python_software_foundation | cpython | < 3.8.20 | 3.8.20 |
| python_software_foundation | cpython | >= 3.10.0 < 3.10.15 | 3.10.15 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.10 | 3.11.10 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.6 | 3.12.6 |
| python_software_foundation | cpython | >= 3.13.0a1 < 3.13.0rc2 | 3.13.0rc2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python2.7 regression
osv·2025-09-29·CVSS 5.3
CVE-2023-27043 [MEDIUM] python2.7 regression
python2.7 regression
USN-7015-4 fixed vulnerabilities in Python. It was discovered that the fix
for CVE-2023-27043 for python2.7 was incorrectly applied on Ubuntu 16.04
LTS and Ubuntu 18.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email module inc
OSV
python2.7 regresssions
osv·2024-11-22·CVSS 5.3
CVE-2023-27043 [MEDIUM] python2.7 regresssions
python2.7 regresssions
USN-7015-5 fixed vulnerabilities in python2.7. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email module incorrectly quoted newlines
for email headers. A remote attacker could possibly
OSV
Tornado has an HTTP cookie parsing DoS vulnerability
osv·2024-11-22·CVSS 7.5
CVE-2024-52804 [HIGH] Tornado has an HTTP cookie parsing DoS vulnerability
Tornado has an HTTP cookie parsing DoS vulnerability
The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.
See also CVE-2024-7592 for a similar vulnerability in cpython.
GHSA
Tornado has an HTTP cookie parsing DoS vulnerability
ghsa·2024-11-22·CVSS 7.5
CVE-2024-52804 [HIGH] CWE-400 Tornado has an HTTP cookie parsing DoS vulnerability
Tornado has an HTTP cookie parsing DoS vulnerability
The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.
See also CVE-2024-7592 for a similar vulnerability in cpython.
OSV
python2.7 vulnerabilities
osv·2024-11-19·CVSS 5.3
CVE-2024-6232 [MEDIUM] python2.7 vulnerabilities
python2.7 vulnerabilities
USN-7015-1 fixed several vulnerabilities in Python. This update provides
the corresponding update for CVE-2024-6232 and CVE-2024-6923 for python2.7
in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS
and Ubuntu 22.04 LTS.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email mod
OSV
python2.7, python3.5 vulnerability
osv·2024-10-14·CVSS 5.3
CVE-2023-27043 [MEDIUM] python2.7, python3.5 vulnerability
python2.7, python3.5 vulnerability
USN-7015-1 fixed several vulnerabilities in Python. This update provides the
corresponding update for CVE-2023-27043 for python2.7 and python3.5 in
Ubuntu 14.04 LTS.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email module incorrectly quoted newlines
for email headers. A remote attacker
OSV
python2.7, python3.5 vulnerability
osv·2024-10-01·CVSS 5.3
CVE-2023-27043 [MEDIUM] python2.7, python3.5 vulnerability
python2.7, python3.5 vulnerability
USN-7015-1 fixed several vulnerabilities in Python. This update provides
the corresponding updates for CVE-2023-27043 for python2.7 in Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS, and for
python3.5 in Ubuntu 16.04 LTS.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the P
OSV
python2.7, python3.5 vulnerabilities
osv·2024-09-19·CVSS 7.5
[HIGH] python2.7, python3.5 vulnerabilities
python2.7, python3.5 vulnerabilities
USN-7015-1 fixed several vulnerabilities in Python. This update provides
one of the corresponding updates for python2.7 for Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS, and a second for
python3.5 for Ubuntu 16.04 LTS.
Original advisory details:
It was discovered that Python allowed excessive backtracking while
parsing certain tarfile headers. A remote attacker could possibly use
this issue to cause Python to consume resources, leading to a denial
of service. This issue only affected python3.5 for
Ubuntu 16.04 LTS (CVE-2024-6232)
It was discovered that the Python http.cookies module incorrectly
handled parsing cookies that contained backslashes for quoted
characters. A remote attacker could possibly use this issue to ca
OSV
python3.10, python3.12, python3.8 vulnerabilities
osv·2024-09-16·CVSS 5.3
CVE-2023-27043 [MEDIUM] python3.10, python3.12, python3.8 vulnerabilities
python3.10, python3.12, python3.8 vulnerabilities
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could possibly
use this issue to bypass certain protection mechanisms. (CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue to
cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email module incorrectly quoted newlines
for email headers. A remote attacker could possibly use this issue to
perform header injection. (CVE-2024-6923)
It was discovered that the Python http.cookies module incorrectly handled
parsing cookies that contained
OSV
CVE-2024-7592: There is a LOW severity vulnerability affecting CPython, specifically the
'http
osv·2024-08-19·CVSS 7.5
CVE-2024-7592 [HIGH] CVE-2024-7592: There is a LOW severity vulnerability affecting CPython, specifically the
'http
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module.
When parsing cookies that contained backslashes for quoted characters in
the cookie value, the parser would use an algorithm with quadratic
complexity, resulting in excess CPU resources being used while parsing the
value.
GHSA
GHSA-7pwv-g7hj-39pr: There is a LOW severity vulnerability affecting CPython, specifically the
'http
ghsa_unreviewed·2024-08-19
CVE-2024-7592 [HIGH] CWE-1333 GHSA-7pwv-g7hj-39pr: There is a LOW severity vulnerability affecting CPython, specifically the
'http
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module.
When parsing cookies that contained backslashes for quoted characters in
the cookie value, the parser would use an algorithm with quadratic
complexity, resulting in excess CPU resources being used while parsing the
value.
OSV
CVE-2024-7592: There is a LOW severity vulnerability affecting CPython, specifically the 'http
osv·2024-08-19·CVSS 7.5
CVE-2024-7592 [HIGH] CVE-2024-7592: There is a LOW severity vulnerability affecting CPython, specifically the 'http
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.
Ubuntu
Python 2.7 regression
vendor_ubuntu·2025-09-29·CVSS 5.3
CVE-2023-27043 [MEDIUM] Python 2.7 regression
Title: Python 2.7 regression
Summary: USN-7015-4 introduced a regression in Python 2.7
USN-7015-4 fixed vulnerabilities in Python. It was discovered that the fix
for CVE-2023-27043 for python2.7 was incorrectly applied on Ubuntu 16.04
LTS and Ubuntu 18.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (Python) — CVE-2024-7592
vendor_oracle·2025-01-15·CVSS 7.5
CVE-2024-7592 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Core (Python) — CVE-2024-7592
Oracle Oracle Communications Applications Risk Matrix: Core (Python) vulnerability
CVE: CVE-2024-7592
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
Ubuntu
Python regressions
vendor_ubuntu·2024-11-22·CVSS 5.3
CVE-2023-27043 [MEDIUM] Python regressions
Title: Python regressions
Summary: USN-7015-5 caused some regressions in Python.
USN-7015-5 fixed vulnerabilities in python2.7. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email module incorrectly quoted n
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-11-19·CVSS 5.3
CVE-2024-6232 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
USN-7015-1 fixed several vulnerabilities in Python. This update provides
the corresponding update for CVE-2024-6232 and CVE-2024-6923 for python2.7
in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS
and Ubuntu 22.04 LTS.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
Ubuntu
Python vulnerability
vendor_ubuntu·2024-10-14·CVSS 5.3
CVE-2023-27043 [MEDIUM] Python vulnerability
Title: Python vulnerability
Summary: Python could me made to bypass some restrictions if it received specially
crafted input.
USN-7015-1 fixed several vulnerabilities in Python. This update provides the
corresponding update for CVE-2023-27043 for python2.7 and python3.5 in
Ubuntu 14.04 LTS.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered th
Ubuntu
Python vulnerability
vendor_ubuntu·2024-10-01·CVSS 5.3
CVE-2023-27043 [MEDIUM] Python vulnerability
Title: Python vulnerability
Summary: Python could be made to bypass some restrictions if it received specially
crafted input.
USN-7015-1 fixed several vulnerabilities in Python. This update provides
the corresponding updates for CVE-2023-27043 for python2.7 in Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS, and for
python3.5 in Ubuntu 16.04 LTS.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to cons
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-09-19·CVSS 7.5
CVE-2024-6232 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
USN-7015-1 fixed several vulnerabilities in Python. This update provides
one of the corresponding updates for python2.7 for Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS, and a second for
python3.5 for Ubuntu 16.04 LTS.
Original advisory details:
It was discovered that Python allowed excessive backtracking while
parsing certain tarfile headers. A remote attacker could possibly use
this issue to cause Python to consume resources, leading to a denial
of service. This issue only affected python3.5 for
Ubuntu 16.04 LTS (CVE-2024-6232)
It was discovered that the Python http.cookies module incorrectly
handled parsing cookies that contained backslashes for quoted
characters. A re
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-09-16·CVSS 5.3
CVE-2024-6923 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could possibly
use this issue to bypass certain protection mechanisms. (CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue to
cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email module incorrectly quoted newlines
for email headers. A remote attacker could possibly use this issue to
perform header injection. (CVE-2024-6923)
It was discovered that the Python http.cookies module incorrectly ha
Red Hat
cpython: python: Uncontrolled CPU resource consumption when in http.cookies module
vendor_redhat·2024-08-19·CVSS 7.5
CVE-2024-7592 [HIGH] CWE-400 cpython: python: Uncontrolled CPU resource consumption when in http.cookies module
cpython: python: Uncontrolled CPU resource consumption when in http.cookies module
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module.
When parsing cookies that contained backslashes for quoted characters in
the cookie value, the parser would use an algorithm with quadratic
complexity, resulting in excess CPU resources being used while parsing the
value.
A flaw was found in the `http.cookies` module in the Python package. When parsing cookies that contain backslashes, under certain circumstances, the module uses an algorithm with quadratic complexity, leading to excessive CPU consumption.
Statement: This vulnerability is classified as low severity, as also marked by upstream Python, because while it can cause excessive CPU us
Microsoft
Quadratic complexity parsing cookies with backslashes
vendor_msrc·2024-08-13·CVSS 7.5
CVE-2024-7592 [HIGH] CWE-1333 Quadratic complexity parsing cookies with backslashes
Quadratic complexity parsing cookies with backslashes
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
PSF: PSF
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.micro
Debian
CVE-2024-7592: pypy3 - There is a LOW severity vulnerability affecting CPython, specifically the 'http....
vendor_debian·2024·CVSS 7.5
CVE-2024-7592 [HIGH] CVE-2024-7592: pypy3 - There is a LOW severity vulnerability affecting CPython, specifically the 'http....
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.
Scope: local
bookworm: open
bullseye: resolved (fixed in 7.3.5+dfsg-2+deb11u5)
forky: resolved (fixed in 7.3.18+dfsg-1)
sid: resolved (fixed in 7.3.18+dfsg-1)
trixie: resolved (fixed in 7.3.18+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5efhttps://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9ahttps://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7fhttps://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1https://github.com/python/cpython/issues/123067https://github.com/python/cpython/pull/123075https://mail.python.org/archives/list/[email protected]/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/https://lists.debian.org/debian-lts-announce/2024/12/msg00000.htmlhttps://security.netapp.com/advisory/ntap-20241018-0006/
2024-08-19
Published