CVE-2026-0672
published 2026-03-16CVE-2026-0672: The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths…
PriorityP336medium6CVSS 4.0
AVNACLATPPRLUINVCLVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.40%
32.4th percentile
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pypy3 | < python3.13 3.13.12-1 (forky) | python3.13 3.13.12-1 (forky) |
| debian | python3.11 | < python3.13 3.13.12-1 (forky) | python3.13 3.13.12-1 (forky) |
| debian | python3.11 | < python3.14 3.14.3-4 (sid) | python3.14 3.14.3-4 (sid) |
| debian | python3.13 | < python3.13 3.13.12-1 (forky) | python3.13 3.13.12-1 (forky) |
| debian | python3.13 | < python3.14 3.14.3-4 (sid) | python3.14 3.14.3-4 (sid) |
| debian | python3.14 | < python3.13 3.13.12-1 (forky) | python3.13 3.13.12-1 (forky) |
| debian | python3.14 | < python3.14 3.14.3-4 (sid) | python3.14 3.14.3-4 (sid) |
| debian | python3.9 | < python3.13 3.13.12-1 (forky) | python3.13 3.13.12-1 (forky) |
| debian | python3.9 | < python3.14 3.14.3-4 (sid) | python3.14 3.14.3-4 (sid) |
| python | python | < 3.13.13 | 3.13.13 |
| python | python | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | >= 3.14.0 < 3.14.4 | 3.14.4 |
| python_software_foundation | cpython | < 3.13.13 | 3.13.13 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.4 | 3.14.4 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0a8 | 3.15.0a8 |
| ubuntu | python3.10 | — | — |
| ubuntu | python3.12 | — | — |
| ubuntu | python3.14 | — | — |
CVSS provenance
nvdv4.06.0MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.0MEDIUM
vendor_debian6.0MEDIUM
vendor_redhat6.0MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 3.3
CVE-2026-9669 [LOW] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly normalized paths in the tarfile
module. An attacker could possibly use this issue to bypass path
restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04
LTS. (CVE-2025-13462)
It was discovered that Python's HTMLParser incorrectly handled certain
malformed HTML input. An attacker could possibly use this issue to cause
Python to crash, resulting in a denial of service. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)
It was discovered that Python's email module incorrectly quoted newlines
in headers. An attacker could possibly use this issue to inject arbitrary
email headers. This issue only affected Ubuntu 22.04 L
Ubuntu
Python 2.7 vulnerabilities
vendor_ubuntu·2026-03-19·CVSS 5.3
CVE-2025-12084 [MEDIUM] Python 2.7 vulnerabilities
Title: Python 2.7 vulnerabilities
Summary: Several security issues were fixed in python2.7
USN-8018-1 fixed CVE-2025-12084, CVE-2025-15282, CVE-2026-0672,
CVE-2026-0865 for python3. This update provides the corresponding updates
for python2.7.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,
python3.13, and python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker
could possibly use this issue to cause a denial of service
Red Hat
cpython: Incomplete control character validation in http.cookies
vendor_redhat·2026-03-16·CVSS 6.0
CVE-2026-3644 [MEDIUM] CWE-791 cpython: Incomplete control character validation in http.cookies
cpython: Incomplete control character validation in http.cookies
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
A control character validation flaw has been discovered in the Python http.cookie module. The Morsel.update(), |= operator, and unpickling paths were not patched to resolve CVE-2026-0672, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Mitigation: Mitigation for this issue is either not available
Ubuntu
Python regression
vendor_ubuntu·2026-03-09·CVSS 5.3
CVE-2025-15367 [MEDIUM] Python regression
Title: Python regression
Summary: USN-8018-1 introduced a regression in Python
USN-8018-1 fixed vulnerabilities in python3. That update introduced
regressions. The patches for CVE-2025-15366 and CVE-2025-15367 caused
behavior regressions in IMAP and POP3 handling, which upstream chose to
avoid by not backporting them. Additionally, the patch for CVE-2026-0865
incorrectly rejected horizontal tabs in wsgiref headers. This update fixes
these problems.
We apologize for the inconvenience.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,
pytho
Ubuntu
Python vulnerabilities
vendor_ubuntu·2026-02-05·CVSS 5.3
CVE-2025-15366 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6, python3.7,
python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and
python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-12084)
It was discovered that Python incorrectly parsed malicious plist files. An
attacker could possibly use this issue to cause Python to use excessive
resources, leading to
Red Hat
cpython: Header injection in http.cookies.Morsel in Python
vendor_redhat·2026-01-20·CVSS 6.0
CVE-2026-0672 [MEDIUM] CWE-93 cpython: Header injection in http.cookies.Morsel in Python
cpython: Header injection in http.cookies.Morsel in Python
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
An injection flaw has been discovered in Python. When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: firefox (Red Hat En
Debian
CVE-2026-0672: pypy3 - When using http.cookies.Morsel, user-controlled cookie values and parameters can...
vendor_debian·2026·CVSS 6.0
CVE-2026-0672 [MEDIUM] CVE-2026-0672: pypy3 - When using http.cookies.Morsel, user-controlled cookie values and parameters can...
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
Debian
CVE-2026-3644: python3.11 - The fix for CVE-2026-0672, which rejected control characters in http.cookies.Mor...
vendor_debian·2026·CVSS 6.0
CVE-2026-3644 [MEDIUM] CVE-2026-3644: python3.11 - The fix for CVE-2026-0672, which rejected control characters in http.cookies.Mor...
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Scope: local
bookworm: open
OSV
python2.7 vulnerabilities
osv·2026-03-19·CVSS 5.7
CVE-2025-12084 [MEDIUM] python2.7 vulnerabilities
python2.7 vulnerabilities
USN-8018-1 fixed CVE-2025-12084, CVE-2025-15282, CVE-2026-0672,
CVE-2026-0865 for python3. This update provides the corresponding updates
for python2.7.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,
python3.13, and python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker
could possibly use this issue to cause a denial of service.
(CVE-2025-12084)
It was discovered that Python incorrectly pars
GHSA
GHSA-vf33-88pf-hwp3: The fix for CVE-2026-0672, which rejected control characters in http
ghsa_unreviewed·2026-03-16·CVSS 6.0
CVE-2026-3644 [MEDIUM] CWE-20 GHSA-vf33-88pf-hwp3: The fix for CVE-2026-0672, which rejected control characters in http
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
OSV
CVE-2026-3644: The fix for CVE-2026-0672, which rejected control characters in http
osv·2026-03-16·CVSS 6.0
CVE-2026-3644 [MEDIUM] CVE-2026-3644: The fix for CVE-2026-0672, which rejected control characters in http
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
OSV
python3.4, python3.5, python3.6, python3.7, python3.8, python3.9,
python3.10, python3.11, python3.12, python3.13, python3.14 regression
osv·2026-03-09·CVSS 5.7
CVE-2025-15366 [MEDIUM] python3.4, python3.5, python3.6, python3.7, python3.8, python3.9,
python3.10, python3.11, python3.12, python3.13, python3.14 regression
python3.4, python3.5, python3.6, python3.7, python3.8, python3.9,
python3.10, python3.11, python3.12, python3.13, python3.14 regression
USN-8018-1 fixed vulnerabilities in python3. That update introduced
regressions. The patches for CVE-2025-15366 and CVE-2025-15367 caused
behavior regressions in IMAP and POP3 handling, which upstream chose to
avoid by not backporting them. Additionally, the patch for CVE-2026-0865
incorrectly rejected horizontal tabs in wsgiref headers. This update fixes
these problems.
We apologize for the inconvenience.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3
OSV
python3.14, python3.13, python3.12, python3.11, python3.10, python3.9,
python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
osv·2026-02-05·CVSS 5.7
CVE-2025-11468 [MEDIUM] python3.14, python3.13, python3.12, python3.11, python3.10, python3.9,
python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
python3.14, python3.13, python3.12, python3.11, python3.10, python3.9,
python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6, python3.7,
python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and
python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-12084)
It was discovered that Python incorrectly parsed malicious plist files. An
attacker could possibly use this issue
GHSA
GHSA-x85f-j5v8-5vrv: When using http
ghsa_unreviewed·2026-01-21
CVE-2026-0672 [MEDIUM] CWE-93 GHSA-x85f-j5v8-5vrv: When using http
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
OSV
CVE-2026-0672: When using http
osv·2026-01-20·CVSS 6.0
CVE-2026-0672 [MEDIUM] CVE-2026-0672: When using http
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-3644 cpython: Incomplete control character validation in http.cookies
bugzilla·2026-03-16·CVSS 6.0
CVE-2026-3644 [MEDIUM] CVE-2026-3644 cpython: Incomplete control character validation in http.cookies
CVE-2026-3644 cpython: Incomplete control character validation in http.cookies
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Bugzilla
CVE-2026-0672 python3.9: Header injection in http.cookies.Morsel in Python [fedora-all]
bugzilla·2026-01-21·CVSS 6.0
CVE-2026-0672 [MEDIUM] CVE-2026-0672 python3.9: Header injection in http.cookies.Morsel in Python [fedora-all]
CVE-2026-0672 python3.9: Header injection in http.cookies.Morsel in Python [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
We're not going to proactively fix this in EOL Pythons in Fedora to keep them as close as possible to their EL clones.
---
*** Bug 2431809 has been marked as a duplicate of this bug. ***
Bugzilla
CVE-2026-0672 asahi-installer: Header injection in http.cookies.Morsel in Python [fedora-42]
bugzilla·2026-01-21·CVSS 6.0
CVE-2026-0672 [MEDIUM] CVE-2026-0672 asahi-installer: Header injection in http.cookies.Morsel in Python [fedora-42]
CVE-2026-0672 asahi-installer: Header injection in http.cookies.Morsel in Python [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, chan
Bugzilla
CVE-2026-0672 python3.9: Header injection in http.cookies.Morsel in Python [fedora-42]
bugzilla·2026-01-21·CVSS 6.0
CVE-2026-0672 [MEDIUM] CVE-2026-0672 python3.9: Header injection in http.cookies.Morsel in Python [fedora-42]
CVE-2026-0672 python3.9: Header injection in http.cookies.Morsel in Python [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
We're not going to proactively fix this in EOL Pythons in Fedora to keep them as close as possible to their EL clones.
---
*** This bug has been marked as a duplicate of bug 2431846 ***
Bugzilla
CVE-2026-0672 python3.6: Header injection in http.cookies.Morsel in Python [fedora-42]
bugzilla·2026-01-21·CVSS 6.0
CVE-2026-0672 [MEDIUM] CVE-2026-0672 python3.6: Header injection in http.cookies.Morsel in Python [fedora-42]
CVE-2026-0672 python3.6: Header injection in http.cookies.Morsel in Python [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
We're not going to proactively fix this in EOL Pythons in Fedora to keep them as close as possible to their EL clones.
---
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package
Bugzilla
CVE-2026-0672 cpython: Header injection in http.cookies.Morsel in Python
bugzilla·2026-01-20·CVSS 6.0
CVE-2026-0672 [MEDIUM] CVE-2026-0672 cpython: Header injection in http.cookies.Morsel in Python
CVE-2026-0672 cpython: Header injection in http.cookies.Morsel in Python
User-controlled cookie values and parameters can allow injecting HTTP headers. Fix rejects all control characters within cookie names, values, and parameters.
Wiz
CVE-2026-0672 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.0
CVE-2026-0672 [MEDIUM] CVE-2026-0672 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0672 :
Python Interpreter vulnerability analysis and mitigation
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Source : NVD
## 6
Score
Published January 20, 2026
Severity MEDIUM
CNA Score 6.0
Affected Technologies
Python Interpreter
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 36.6
Exploitation Probability (EPSS) 0.2
Affected packages and libraries
python3.10-tkinter
python311-devel
Sources
NVD
CBL-Mariner 2.0 Severity MEDIUM Has Fix Added at: Feb 08, 2026
CBL-Mariner 3.0 Severity MEDIUM Has Fix Add
Wiz
CVE-2026-3644 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 2.0
CVE-2026-3644 [LOW] CVE-2026-3644 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-3644 :
Python Interpreter vulnerability analysis and mitigation
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Source : NVD
## 6
Score
Published March 16, 2026
Severity MEDIUM
CNA Score 6.0
Affected Technologies
Python Interpreter
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 29.8
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
python3.11-debug
python39-devel:3.9::m
https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590ddhttps://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979ddhttps://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cefhttps://github.com/python/cpython/issues/145599https://github.com/python/cpython/pull/145600https://mail.python.org/archives/list/[email protected]/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/
2026-03-16
Published