Medium severity · published Jan 20, 2026
CVE-2026-0672
Header injection in http.cookies.Morsel
6.0
CVSS
0.5%
EPSS
No
On KEV
Description
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.10.20; 3.11.0 before 3.11.15; 3.12.0 before 3.12.13; 3.13.0 before 3.13.12; 3.14.0 before 3.14.3; 3.15.0a1 before 3.15.0a6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0672
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0672
github.com
https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172
github.com
https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440
github.com
https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d
github.com
https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca
github.com
https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70
github.com
https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.4
CVE-2025-4517
Arbitrary writes via tarfile realpath overflow
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.7
CVE-2024-8088
Infinite loop when iterating over zip archive entry names from zipfile.Path