The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
3.10.213.11.163.12.143.13.133.14.43.15.0a83.10.213.11.163.12.143.13.133.14.43.15.0a8Exploitability
AV:NAC:LAT:PPR:LUI:NVulnerable System
VC:LVI:HVA:NSubsequent System
SC:NSI:NSA:N6/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N