CVE-2026-3644

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3644
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4 Patch
https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd Patch
https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd Patch
https://github.com/python/cpython/issues/145599 Issue Tracking
https://github.com/python/cpython/pull/145600 Patch
https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/ Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*
History

04 Jun 2026, 19:30

Type Values Removed Values Added
CPE cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*
Summary
  • (es) La solución para CVE-2026-0672, que rechazaba caracteres de control en http.cookies.Morsel, era incompleta. Los métodos Morsel.update(), el operador |= y las rutas de deserialización no fueron parcheados, permitiendo que los caracteres de control eludieran la validación de entrada. Además, BaseCookie.js_output() carecía de la validación de salida aplicada a BaseCookie.output().
First Time Python
Python python
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4 - () https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4 - Patch
References () https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd - () https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd - Patch
References () https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd - () https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd - Patch
References () https://github.com/python/cpython/issues/145599 - () https://github.com/python/cpython/issues/145599 - Issue Tracking
References () https://github.com/python/cpython/pull/145600 - () https://github.com/python/cpython/pull/145600 - Patch
References () https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/ - () https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/ - Third Party Advisory

16 Mar 2026, 19:16

Type Values Removed Values Added
CWE CWE-20
CWE-116

16 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-16 18:16

Updated : 2026-06-04 19:30

NVD link : CVE-2026-3644

Mitre link : CVE-2026-3644

CVE.ORG link : CVE-2026-3644

JSON object : View

Products Affected

python

  • python
CWE
CWE-20

Improper Input Validation

CWE-116

Improper Encoding or Escaping of Output