PSF-2026-5

UNKNOWN

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and param

Published Jan 20, 2026

Modified 1 months ago

Fix available

Details

Affected Packages

Python

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1809) / Server 2019Windows 10 (1903)Windows 10 (1909)

Fixed in:

3.10.203.11.153.12.133.13.123.14.33.15.0a6

References

FIX

https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172

FIX

https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440

FIX

https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d

FIX

https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca

FIX

https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70

FIX

https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85

REPORT

https://github.com/python/cpython/issues/143919

WEB

https://github.com/python/cpython/pull/143920

ADVISORY

https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/

Aliases

CVE-2026-0672

Ecosystems(20)

Windows 10 (1507)Windows 10 (1607) / Server 2016 Windows 10 (1809) / Server 2019 Windows 10 (1903)Windows 10 (1909)

Timeline

PublishedJan 20, 2026

ModifiedJan 26, 2026

PSF-2026-5 | Mondoo Vulnerability Intelligence