Reject control characters in more places in http.cookies.Morsel #145599

Activity

1. StanFromIreland

   self-assigned this

   on Mar 6, 2026
2. StanFromIreland

   added

   type-securityA security issueA security issue

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on Mar 6, 2026
3. vstinner

   added a commit that references this issue on Mar 16, 2026

   gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.…

   ...

   57e88c1
4. miss-islington

   added 4 commits that reference this issue on Mar 16, 2026

   pythongh-145599, CVE 2026-3644: Reject control characters in `http.co…

   ...

   cf297a5

   pythongh-145599, CVE 2026-3644: Reject control characters in `http.co…

   ...

   49a4116

   pythongh-145599, CVE 2026-3644: Reject control characters in `http.co…

   ...

   736de53

   pythongh-145599, CVE 2026-3644: Reject control characters in `http.co…

   ...

   37b75af
5. vstinner

   added a commit that references this issue on Mar 16, 2026

   pythongh-145599, CVE 2026-3644: Reject control characters in `http.co…

   ...

   d46a497
6. vstinner

   closed this as completedon Mar 16, 2026
7. vstinner

   added 2 commits that reference this issue on Mar 16, 2026

   [3.13] gh-145599, CVE 2026-3644: Reject control characters in `http.c…

   ...

   d16ecc6

   [3.14] gh-145599, CVE 2026-3644: Reject control characters in `http.c…

   ...

   62ceb39
8. nikhilgv commented on Mar 19, 2026

   

   nikhilgv

   on Mar 19, 2026

   More actions

   Hello @StanFromIreland, will this be backported to 3.9?
9. vstinner commented on Mar 19, 2026

   

   vstinner

   on Mar 19, 2026

   Member

   More actions

   Hello @StanFromIreland, will this be backported to 3.9?

   Sadly no, Python 3.9 reached its end-of-life last year, and it no longer gets security fixes: https://devguide.python.org/versions/ It's now time to upgrade to a newer Python version.

   If you cannot upgrade, you should be able to copy Lib/http/cookies.py from a recent Python version to your project.

   👍React with 👍1Reacted by Stan Ulbrych
10. mandree

    added a commit that references this issue on Apr 8, 2026

    lang/python314: security update to 3.14.4

    ...

    a045632
11. 2 remaining items

    Load more
12. mandree

    added 2 commits that reference this issue on Apr 11, 2026

    lang/python314: security update to 3.14.4

    ...

    b526f87

    lang/python314: security update to 3.14.4

    ...

    62a66cb
13. freebsd-git

    added 2 commits that reference this issue on Apr 12, 2026

    lang/python314: Security update to 3.14.4

    ...

    955268b

    lang/python314: Security update to 3.14.4

    ...

    cb35b3d
14. ljfp

    added a commit that references this issue on Apr 25, 2026

    pythongh-145599, CVE 2026-3644: Reject control characters in `http.co…

    ...

    c9b0768
15. pablogsal

    added 2 commits that reference this issue on Jun 27, 2026

    [3.10] gh-145599, CVE 2026-3644: Reject control characters in `http.c…

    ...

    556aa09

    [3.11] gh-145599, CVE 2026-3644: Reject control characters in `http.c…

    ...

    dae4b1a
16. camachat

    added 2 commits that reference this issue on Jul 22, 2026

    lang/python314: Security update to 3.14.4

    ...

    7b1d556

    lang/python314: Security update to 3.14.4

    ...

    ec484f0
17. Yhg1s

    added a commit that references this issue on Aug 4, 2026

    [3.12] gh-145599, CVE 2026-3644: Reject control characters in `http.c…

    ...

    3974092
18. arnout

    added a commit that references this issue on Aug 14, 2026

    package/python3: security bump to v3.12.14

    ...

    80251a0
19. mcepl

    added 2 commits that reference this issue on Sep 18, 2026

    [CVE 2026-3644] Reject control characters in `http.cookies.Morsel.upd…

    ...

    8ff85ef

    [CVE 2026-3644] Reject control characters in `http.cookies.Morsel.upd…

    ...

    50f253d
20. mcepl

    added 2 commits that reference this issue on Oct 1, 2026

    [CVE 2026-3644] Reject control characters in `http.cookies.Morsel.upd…

    ...

    eb8951b

    [CVE 2026-3644] Reject control characters in `http.cookies.Morsel.upd…

    ...

    f885e46