Is CVE-2026-16052 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16052 being exploited in the wild.

How severe is CVE-2026-16052?

Informational severity, published 12 November 2026.

Which products and versions are affected?

Python CPython all versions up to and including the main branch as of 2026-11-09.

How is CVE-2026-16052 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16052?

Check whether you run Python CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16052: Python http.cookies Morsel cookie attribute injection via unescaped semicolons

CVE-2026-16052 · Severity: info · Published 2026-11-12

Python's http.cookies.Morsel class fails to escape semicolons in cookie attribute values, allowing attackers who control these values to inject malicious attributes. This could enable an attacker to weaken a cookie's security restrictions by downgrading SameSite policies or expanding the parent domain, potentially leading to unauthorized access to sensitive user data or session hijacking.

Technologies: Python CPython. Vendors: Python.

Quick answers

Is CVE-2026-16052 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16052 being exploited in the wild.
How severe is CVE-2026-16052?: Informational severity, published 12 November 2026.
Which products and versions are affected?: Python CPython all versions up to and including the main branch as of 2026-11-09.
Is there a fix for CVE-2026-16052?: A patch was published on 2026-11-12: Fix merged into main branch (PR #161711) Until you apply it: Applications should validate and sanitize any untrusted input before using it to set cookie attributes, ensuring no semicolons are present in path, domain, samesite, or version attribute values. Alternatively, upgrade to a patched version of Python once available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16052 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16052?: Check whether you run Python CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Applications should validate and sanitize any untrusted input before using it to set cookie attributes, ensuring no semicolons are present in path, domain, samesite, or version attribute values. Alternatively, upgrade to a patched version of Python once available.

Technical details

The Morsel.OutputString() method does not reject or escape semicolons (0x3B), which are the Set-Cookie attribute delimiters per RFC 6265, in attribute values for path, domain, samesite, and version. An attacker who can control these attribute values can inject arbitrary Set-Cookie attributes such as Domain, SameSite, Secure, and HttpOnly. The vulnerability requires the application to reflect untrusted input into cookie attributes and can result in SameSite policy downgrade or parent domain expansion attacks.

Affected products

Python CPython all versions up to and including the main branch as of 2026-11-09

Timeline

2026-11-09: disclosed: Issue reported
2026-11-12: advisory: CVE-2026-16052 published
2026-11-12: patched: Fix merged into main branch (PR #161711)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.