UpHeron
All vulnerabilities

Servers and applications

CVE-2026-16052

Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel

Severity
Low 2.3
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
3.16.0
Weakness
Injection (CWE-74)
Attack
Over the network · Only under certain conditions · No login needed · Needs someone to view a page or file
Attacker can
Change some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Sources
CVE Program

Description

The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.

From the CVE Program.

Affected software

SoftwareAffected versions
PythonServers and applications · cna:python software foundation|cpython
  • Every version before 3.16.0

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-16052