CVE-2026-0672

Not yet scoredAwaiting CVSS assessment

Published

January 20, 2026

Affected

1 project

Assigned by

Description

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

python/cpython

GitHubThe Python programming language

NVD

More on this CVE

NVD↗GitHub Advisory↗

Security Advisories

CVE-2026-0672

Description

More on this CVE