CVE-2024-7592: Quadratic complexity parsing cookies with backslashes

Published Aug 19, 2024
·
Updated

Last updated 19 September 2024

Other sources

Quadratic complexity parsing cookies with backslashes

— Microsoft

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module.

When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

— NVD

This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.

— Launchpad

Affected Software

43 affected componentsFixes available
F5 BIG-IP Next SPK>=1.7.0<=1.9.2
F5 BIG-IP Next CNF>=1.1.0<=1.3.3
IBM Concert Software<=1.0.0-1.1.0
Python Python<3.8.20
Python Python>=3.9.0<3.9.20
Python Python>=3.10.0<3.10.15
Python Python>=3.11.0<3.11.10
Python Python>=3.12.0<3.12.6
Python Python=3.13.0-alpha0
Python Python=3.13.0-alpha1
Python Python=3.13.0-alpha2
Python Python=3.13.0-alpha3
Python Python=3.13.0-alpha4
Python Python=3.13.0-alpha5
Python Python=3.13.0-alpha6
Python Python=3.13.0-beta1
Python Python=3.13.0-beta2
Python Python=3.13.0-beta3
Python Python=3.13.0-beta4
Python Python=3.13.0-rc1
All of the following
azurelinux/python3<3.9.19-4
3.9.19-4
Microsoft CBL-Mariner=2.0
All of the following
azurelinux/tensorflow<2.16.1-6
2.16.1-6
Microsoft Azure Linux=3.0
All of the following
azurelinux/python3<3.12.3-2
3.12.3-2
Microsoft Azure Linux=3.0
debian/pypy3*
debian/pypy3<7.3.18+dfsg-1
7.3.18+dfsg-1
debian/pypy3<7.3.18+dfsg-1
7.3.18+dfsg-1
debian/python3.11<3.11.2-6+deb12u5
3.11.2-6+deb12u5
debian/python3.13<3.13.0~rc2-1
3.13.0~rc2-1
debian/pypy3<=7.3.11+dfsg-2+deb12u3
7.3.19+dfsg-28.0.1+dfsg-1
debian/python3.11
3.11.2-6+deb12u83.11.2-6+deb12u9
debian/python3.13
3.13.5-2+deb13u53.13.18-1
alpine/py3-tornado<6.4.2-r0
6.4.2-r0
alpine/python3<3.10.15-r0
3.10.15-r0
alpine/python3<3.11.10-r0
3.11.10-r0
alpine/python3<3.11.10-r0
3.11.10-r0
alpine/python3<3.12.6-r0
3.12.6-r0
alpine/python3<3.12.6-r0
3.12.6-r0
alpine/python3<3.12.6-r0
3.12.6-r0
alpine/python3<3.12.6-r0
3.12.6-r0
alpine/python3<3.12.6-r0
3.12.6-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade azurelinux/python3 to a version that resolves this vulnerability.

    Fixed in 3.9.19-4
  2. Upgrade

    Upgrade azurelinux/tensorflow to a version that resolves this vulnerability.

    Fixed in 2.16.1-6
  3. Upgrade

    Upgrade azurelinux/python3 to a version that resolves this vulnerability.

    Fixed in 3.12.3-2
  4. Upgrade

    Upgrade debian/pypy3 to a version that resolves this vulnerability.

    Fixed in 7.3.18+dfsg-1
  5. Upgrade

    Upgrade debian/python3.11 to a version that resolves this vulnerability.

    Fixed in 3.11.2-6+deb12u5
  6. Upgrade

    Upgrade debian/python3.13 to a version that resolves this vulnerability.

    Fixed in 3.13.0~rc2-1
  7. Upgrade

    Upgrade debian/pypy3 to a version that resolves this vulnerability.

    Fixed in 7.3.19+dfsg-2Fixed in 8.0.1+dfsg-1
  8. Upgrade

    Upgrade debian/python3.11 to a version that resolves this vulnerability.

    Fixed in 3.11.2-6+deb12u8Fixed in 3.11.2-6+deb12u9
  9. Upgrade

    Upgrade debian/python3.13 to a version that resolves this vulnerability.

    Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1
  10. Upgrade

    Upgrade alpine/py3-tornado to a version that resolves this vulnerability.

    Fixed in 6.4.2-r0
  11. Upgrade

    Upgrade alpine/python3 to a version that resolves this vulnerability.

    Fixed in 3.10.15-r0
  12. Upgrade

    Upgrade alpine/python3 to a version that resolves this vulnerability.

    Fixed in 3.11.10-r0
  13. Upgrade

    Upgrade alpine/python3 to a version that resolves this vulnerability.

    Fixed in 3.12.6-r0

Event History

Aug 19, 2024
CVE Published
via MITRE·07:06 PM
Data Sourced
via MITRE·07:06 PM
DescriptionWeakness
Data Sourced
via OSV·07:06 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·07:15 PM
Affected Software
Sep 11, 2024
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeaknessAffected Software
Dec 12, 2024
Advisory Published
via F5·09:19 PM
Aug 18, 2025
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2024-7592?

CVE-2024-7592 is classified as a LOW severity vulnerability.

2

How do I fix CVE-2024-7592?

To fix CVE-2024-7592, update to the recommended versions of Python provided by the affected software vendor.

3

Which versions of Python are affected by CVE-2024-7592?

CVE-2024-7592 affects specific versions of Python from 3.9.2 up to 3.12.5, including certain alpha and beta releases of 3.13.

4

What impact does CVE-2024-7592 have on applications?

CVE-2024-7592 can potentially lead to improper handling of backslashes in cookie values, which may affect application behavior.

5

Where can I find more information about CVE-2024-7592?

Further details about CVE-2024-7592 can be found in security advisories and vulnerability databases.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203