UpHeron
All vulnerabilities

Servers and applications

CVE-2026-3644

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

Severity
Medium 6.0
Published
16 Mar 2026
Last changed
13 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.13.13, 3.14.4
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • Version 3.15.0-alpha7
  • Version 3.15.0-alpha6
  • Version 3.15.0-alpha5
  • Version 3.15.0-alpha4
All 9 release lines
  • Every version before 3.13.13
  • From 3.14.0 before 3.14.4
  • Version 3.15.0-alpha1
  • Version 3.15.0-alpha2
  • Version 3.15.0-alpha3
  • Version 3.15.0-alpha4
  • Version 3.15.0-alpha5
  • Version 3.15.0-alpha6
  • Version 3.15.0-alpha7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-3644
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-3644