QwikSec

Security Database

CVE

CWE

Training

CVE-2026-3644

Published: Mar 16, 2026

Modified: Apr 7, 2026

PUBLISHED

Description

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

Vendor	Product	Versions
Python Software Foundation	CPython	affected `0 - < 3.13.13` affected `3.14.0 - < 3.14.4` affected `3.15.0a1 - < 3.15.0a8`

References

https://mail.python.org/archives/list/[email protected]/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/

vendor-advisory

https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4

patch

https://github.com/python/cpython/issues/145599

issue-tracking

https://github.com/python/cpython/pull/145600

patch

https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd

patch

https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd

patch

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.