CVE-2026-3644 addresses an incomplete fix in CPython's http.cookies module, where specific functions and paths still allow control characters to bypass input validation, and `BaseCookie.js_output()` lacks proper output validation. Rated 6.0 MEDIUM (CVSSv4), this vulnerability has a network attack vector and low attack complexity, potentially leading to high integrity impact due to improper input and output handling. There is no evidence of active exploitation, nor are public exploit codes available, and it is not listed on CISA's KEV catalog. Community and media attention are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, < 3.13.13CPE match | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | ||
>= 3.14.0, < 3.14.4CPE match | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | ||
< 3.13.13CPE matchmatch criteria | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | ||
3.15.0CPE matchmatch criteria | cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:* | ||
3.15.0CPE matchmatch criteria | cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.