AZL-113810: CVE-2026-16052 affecting package python3 3.12.16-2

Q: What does an attacker need to control to exploit this issue?

The attacker needs control over values assigned to http.cookies.Morsel attributes. Semicolon separators in those values are then included verbatim in cookie output, which can be used to relax Domain or SameSite restrictions.

Q: What security controls can be weakened through exploitation?

The issue can relax a cookie's Domain restriction or SameSite restriction. The provided information does not identify specific affected application configurations or exposure conditions beyond attacker control of Morsel attribute values.

Published Nov 12, 2026

Updated

The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.

Affected Software

1 affected component

azure-linux/python3<=3.12.16-2

Event History

Nov 12, 2026

Advisory Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-16052

Frequently Asked Questions

What does an attacker need to control to exploit this issue?

The attacker needs control over values assigned to http.cookies.Morsel attributes. Semicolon separators in those values are then included verbatim in cookie output, which can be used to relax Domain or SameSite restrictions.

What security controls can be weakened through exploitation?

The issue can relax a cookie's Domain restriction or SameSite restriction. The provided information does not identify specific affected application configurations or exposure conditions beyond attacker control of Morsel attribute values.

AZL-113810: CVE-2026-16052 affecting package python3 3.12.16-2

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to control to exploit this issue?

What security controls can be weakened through exploitation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to control to exploit this issue?

What security controls can be weakened through exploitation?