{"id":"CVE-2026-3644","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-3644","generatedAt":"2026-10-28T04:46:14.586Z","title":"The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation.","description":"The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().","published":"2026-03-16T18:16:10.000Z","lastModified":"2026-08-13T01:16:53.000Z","status":"Modified","sourceIdentifier":"cna@python.org","cvss":{"version":"4.0","score":6,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-20","CWE-116"],"affected":["python/python"],"epss":{"score":0.00497,"percentile":0.42408,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.50%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4","tags":["Patch"],"source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd","tags":["Patch"],"source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd","tags":["Patch"],"source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef","source":"cna@python.org"},{"url":"https://github.com/python/cpython/issues/145599","tags":["Issue Tracking"],"source":"cna@python.org"},{"url":"https://github.com/python/cpython/pull/145600","tags":["Patch"],"source":"cna@python.org"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/","tags":["Third Party Advisory"],"source":"cna@python.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-3644","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}