REDHAT-BUG-2448168: Input Validation
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.jsoutput() lacked the output validation applied to BaseCookie.output().
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2448168?
The severity of REDHAT-BUG-2448168 is medium, rated at 4.
How do I fix REDHAT-BUG-2448168?
To fix REDHAT-BUG-2448168, ensure you apply the latest updates provided by the Python Software Foundation.
What components are affected by REDHAT-BUG-2448168?
REDHAT-BUG-2448168 affects the http.cookies module of CPython, specifically the Morsel and BaseCookie classes.
What vulnerabilities are related to REDHAT-BUG-2448168?
REDHAT-BUG-2448168 is related to an incomplete fix for CVE-2026-0672, concerning control character input validation.
When was REDHAT-BUG-2448168 published?
REDHAT-BUG-2448168 was published on March 16, 2026.