Vulnerability in Python Software Foundation Cpython
CVE-2026-0672
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Vulnerability class: CRLF Injection
EPSS: 0.004 (32.8th percentile) — read the EPSS interpretation.
Affected products
- Python Software Foundation Cpython — versions 0, 3.11.0, 3.12.0
Weakness classification (CWE)
References
- cna@python.org (patch)
- cna@python.org (issue-tracking)
- cna@python.org (vendor-advisory)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)