CVE-2026-0672: Header injection in http.cookies.Morsel
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If you must continue using a vulnerable version, prevent untrusted users from supplying cookie names/values/parameters that are used to create http.cookies.Morsel messages.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0672?
CVE-2026-0672 is considered a moderate severity vulnerability impacting the http.cookies.Morsel module in Python.
How do I fix CVE-2026-0672?
To fix CVE-2026-0672, update your Python installation to a version that includes the patch rejecting control characters in cookie names, values, and parameters.
Who is affected by CVE-2026-0672?
Users and developers utilizing the http.cookies.Morsel module in Python applications are affected by CVE-2026-0672.
What are the potential implications of CVE-2026-0672?
CVE-2026-0672 can lead to HTTP header injection, which may allow attackers to manipulate server responses.
Is there a workaround for CVE-2026-0672?
It is recommended to validate and sanitize cookie inputs as a temporary workaround for CVE-2026-0672 until a patch is applied.