High severity · published Aug 19, 2024
CVE-2024-7592
Quadratic complexity parsing cookies with backslashes
7.5
CVSS
2.3%
EPSS
No
On KEV
Description
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module.
When parsing cookies that contained backslashes for quoted characters in
the cookie value, the parser would use an algorithm with quadratic
complexity, resulting in excess CPU resources being used while parsing the
value.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.8.20; 3.9.0 before 3.9.20; 3.10.0 before 3.10.15; 3.11.0 before 3.11.10; 3.12.0 before 3.12.6; 3.13.0a1 before 3.13.0rc2 · source: vendor, CISA
PY
Python · Python
before 3.8.20; 3.9.0 before 3.9.20; 3.10.0 before 3.10.15; 3.11.0 before 3.11.10; 3.12.0 before 3.12.6; 3.13.0; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7592
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7592
Patch
https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621
Patch
https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef
Patch
https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06
Patch
https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a
Patch
https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f
Patch
https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.4
CVE-2025-4517
Arbitrary writes via tarfile realpath overflow
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.7
CVE-2024-8088
Infinite loop when iterating over zip archive entry names from zipfile.Path
