CVE-2026-16052

UNKNOWN 0.0

Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.

CWE	CWE-74
Vendor	python software foundation
Product	cpython
Published	Nov 12, 2026

Stay Ahead of the Next One

Get instant alerts for python software foundation cpython

Be the first to know when new unknown vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Python Software Foundation / CPython

0 < 3.16.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/python/cpython/pull/161711 github.com: https://github.com/python/cpython/issues/161707 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/IZL4QUFV7PKGT2JYSU2DCBMLTWYJDGKZ/

Credits

🔍 Qi Deng (https://github.com/ikow) Stan Ulbrych (https://github.com/StanFromIreland) Brett Smith (https://github.com/brettcs) Seth Larson (https://github.com/sethmlarson) Victor Stinner (https://github.com/vstinner) Senthil Kumaran (https://github.com/orsenthil)