CVE-2026-0672 is a medium-severity vulnerability affecting the http.cookies.Morsel component, allowing HTTP header injection through user-controlled cookie values and parameters. This flaw, rated 6.0 on CVSS, has a low attack complexity and requires low privileges, potentially leading to high integrity impacts. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and concern within the security community. The patch addresses this by rejecting all control characters in cookie names, values, and parameters.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, < 3.10.20CPE match | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | ||
>= 3.11.0, < 3.11.15CPE match | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | ||
>= 3.12.0, < 3.12.13CPE match | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | ||
>= 3.13.0, < 3.13.12CPE match | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | ||
>= 3.14.0, < 3.14.3CPE match | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Python vulnerabilities
Jul 6, 2026USN-8018-3: Python 2.7 vulnerabilities
Mar 19, 2026USN-8018-3: Python 2.7 vulnerabilities
Mar 19, 2026cpython: Header injection in http.cookies.Morsel in Python
Jan 20, 2026