CVE-2026-3644: Incomplete control character validation in http.cookies
Incomplete control character validation in http.cookies
Other sources
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.jsoutput() lacked the output validation applied to BaseCookie.output().
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u2Fixed in 3.13.14-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.6-1 - Upgrade
Upgrade
debian/python3.9to a version that resolves this vulnerability.Fixed in 3.9.2-1+deb11u7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3644?
CVE-2026-3644 has been classified as a moderate severity vulnerability.
How do I fix CVE-2026-3644?
To fix CVE-2026-3644, you should update to the latest version of Python where the vulnerability has been patched.
What are the risks associated with CVE-2026-3644?
CVE-2026-3644 poses risks including potential bypass of input validation which could lead to security breaches or data corruption.
Where does CVE-2026-3644 affect Python?
CVE-2026-3644 affects the http.cookies module in CPython, specifically the Morsel.update() and unpickling paths.
Is my application vulnerable to CVE-2026-3644?
If your application uses a vulnerable version of CPython and relies on the http.cookies module, it may be susceptible to CVE-2026-3644.