logo

Database

Lack of data validation In python3.14

Description

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 23

10

Aliases

1. CVE-2026-36442. NVD-2026-36443. OSV-2026-36444. OSV-DEBIAN-2026-36445. OSV-ALPINE-2026-36446. GCVE-2026-36447. SECURITY-TRACKER-CVE-2026-36448. SECURITY-CVE-2026-36449. https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3644.json10. mail.python.org

References

1. https://github.com/python/cpython/issues/1455992. https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d3303. https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d84. https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b45. https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd6. https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd7. https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef8. https://github.com/python/cpython/pull/145600

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.