PT-2026-25789 · Python · Cpython

Seth Larson + 3 · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-3644

NVD

CVSS v4.0

6.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js output() lacked the output validation applied to BaseCookie.output().

Fix

RCE

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-20

CWE-116

Related Identifiers

CVE-2026-3644

Affected Products

Cpython

References · 7

• https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd · Patch
• https://github.com/python/cpython/pull/145600 · Patch
• https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4 · Patch
• https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd · Patch
• https://mail.python.org/archives/list/[e-mail]/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3644 · Security Note
• https://github.com/python/cpython/issues/145599 · Note