Medium 6.0Published Jan 20, 2026

CVE-2026-0672Header injection in http.cookies.Morsel

Updated under an hour ago (Oct 26, 2026, 3:30 PM ET)

Does this affect you?

It affects Python Software Foundation CPython. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Python Software Foundation CPython

Exploited in the last 30 days

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

CVSS: 6.0 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-93
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: PSF
NVD analysis: Deferred
Record last updated: Mar 3, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Python Software Foundation CPython python_software_foundation:cpython (from the name)	before 3.10.20; from 3.11.0 before 3.11.15; from 3.12.0 before 3.12.13; from 3.13.0 before 3.13.12; from 3.14.0 before 3.14.3; from 3.15.0a1 before 3.15.0a6	CNA record

References

References

https://github.com/python/cpython/pull/143920	patch
https://github.com/python/cpython/issues/143919	issue-tracking
https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/	vendor-advisory
https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70	patch
https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440	patch
https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172	patch
https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d	patch
https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca	patch
https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.