CVE-2026-3644

Name
CVE-2026-3644
Description
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cna@python.org https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4
cna@python.org https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd
cna@python.org https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd
cna@python.org https://github.com/python/cpython/issues/145599
cna@python.org https://github.com/python/cpython/pull/145600
cna@python.org https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/
cna@python.org https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8
cna@python.org https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef
cna@python.org https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* python >= None < 3.13.13
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* python >= 3.14.0 < 3.14.4
cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:* python == None == 3.15.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
python3 edge-main 3.14.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.24-main 3.14.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.23-main 3.12.14-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.22-main 3.12.14-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.21-main 3.12.14-r0 Natanael Copa <ncopa@alpinelinux.org> fixed