Junglewise Threat Intelligence

CVE-2026-3644: Python CPython incomplete control character validation in http.cookies

CVE-2026-3644 · Severity: high · CVSS 7.5 · Published 2026-03-16

Vendors: Python Software Foundation.

Executive brief

A vulnerability in Python's standard library could allow attackers to bypass security checks when handling web cookies. By injecting special control characters into cookie data, an attacker might be able to manipulate how a web browser or server processes session information. This could lead to unauthorized changes in application behavior or security bypasses in web-based services.

Technical details

This vulnerability is an incomplete fix for a previous issue (CVE-2026-0672) regarding control character validation in the http.cookies.Morsel class. While some paths were previously secured, the Morsel.update() method, the |= operator, and unpickling routines remained unpatched, allowing control characters to bypass input validation. Furthermore, BaseCookie.js_output() lacked the output validation present in BaseCookie.output(). An attacker can exploit this by providing specially crafted cookie data that includes control characters, which could be used to perform cookie injection attacks. Patches have been released for affected CPython branches including 3.13 and 3.14.

Affected products

  • Python Software Foundation Python (CPython) < 3.13.13, 3.14.0 - 3.14.4, 3.15.0a1 - 3.15.0a7

Timeline

  • 2026-03-06: other: Issue reported and initial PRs created
  • 2026-03-16: disclosed: Vulnerability disclosed and CVE assigned
  • 2026-03-16: patched: Fixes merged into main CPython branches
  • 2026-03-16: advisory: Security announcement sent to python-announce mailing list

References