CVE-2026-0672 json
Header injection in http.cookies.Morsel
published 2026-01-20 9 mo ago modified 2026-06-17 4 mo ago also BIT-libpython-2026-0672 , BIT-python-2026-0672 , BIT-python-min-2026-0672 , EUVD-2026-3521
- cvss
- 6.0
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Patch / fix
- bitnami libpython 3.10.20, 3.11.15, 3.12.13, 3.13.12, 3.14.3
- bitnami python 3.10.20, 3.11.15, 3.12.13, 3.13.12, 3.14.3
- bitnami python-min 3.10.20, 3.11.15, 3.12.13, 3.13.12, 3.14.3
- Python Software Foundation CPython 3.10.20, 3.11.15, 3.12.13, 3.13.12, 3.14.3, 3.15.0a6
- pypy3 Debian 14 7.3.21+dfsg-1
- python3.11 Debian 12 3.11.2-6+deb12u7
- python3.13 Debian 13 3.13.5-2+deb13u1
- python3.14 Debian 14 3.14.3-1
debian advisories DEBIAN-CVE-2026-0672
- python3.10 Ubuntu 22.04 LTS 3.10.12-1~22.04.14
- python3.12 Ubuntu 24.04 LTS 3.12.3-1ubuntu0.11
- python3.13 Ubuntu 25.10 3.13.7-1ubuntu0.3
- python3.14 Ubuntu 25.10 3.14.0-1ubuntu0.2
- python2.7 Ubuntu Pro 14.04 LTS 2.7.6-8ubuntu0.6+esm29
- python2.7 Ubuntu Pro 16.04 LTS 2.7.12-1ubuntu0~16.04.18+esm19
- python2.7 Ubuntu Pro 18.04 LTS 2.7.17-1~18.04ubuntu1.13+esm14
- python2.7 Ubuntu Pro 22.04 LTS 2.7.18-13ubuntu1.5+esm8
ubuntu advisories UBUNTU-CVE-2026-0672
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python3.12 RHEL 9 3.12.13-2.el9_8
- python3.12-idle RHEL 9 3.12.13-2.el9_8
- python3.12-libs RHEL 9 3.12.13-2.el9_8
- python3.12-test RHEL 9 3.12.13-2.el9_8
- python3.12-tkinter RHEL 9 3.12.13-2.el9_8
- python3.12 RHEL 10.2 3.12.13-2.el10_2
- python3 RHEL 10.2 3.12.13-2.el10_2
- python3-idle RHEL 10.2 3.12.13-2.el10_2
red hat advisories RHSA-2026:19177RHSA-2026:19064RHSA-2026:10950
- python311 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +6 more 3.11.15-150400.9.80.1
- python311-core SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +6 more 3.11.15-150400.9.80.1
- python311-documentation SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 3.11.15-150400.9.80.1
- python311 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Python 3 15 SP7 +1 more 3.11.15-150600.3.53.1
- python311-core SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Python 3 15 SP7 +2 more 3.11.15-150600.3.53.1
- python311-documentation openSUSE Leap 15.6 3.11.15-150600.3.53.1
- python311 Linux Micro 6.1 3.11.15-slfo.1.1_1.1
- python311-core Linux Micro 6.1 3.11.15-slfo.1.1_1.1
suse advisories SUSE-SU-2026:1117-1SUSE-SU-2026:1349-1SUSE-SU-2026:20768-1SUSE-SU-2026:20796-1SUSE-SU-2026:20665-1SUSE-SU-2026:20710-1
- python-M2Crypto openSUSE Tumbleweed 0.48.0-1.1
- python313 openSUSE Leap 16.0 3.13.12-160000.1.1
- python313-core openSUSE Leap 16.0 3.13.12-160000.1.1
- python313-nogil openSUSE Leap 16.0 3.13.12-160000.1.1
- python313-documentation openSUSE Leap 16.0 3.13.12-160000.1.1
- python313-nogil-nogil-core openSUSE Leap 16.0 3.13.12-160000.1.1
- python311 openSUSE Tumbleweed 3.11.14-4.1
- python312 openSUSE Tumbleweed 3.12.12-5.1
opensuse advisories openSUSE-SU-2026:10990-1openSUSE-SU-2026:20254-1openSUSE-SU-2026:10221-1openSUSE-SU-2026:10222-1openSUSE-SU-2026:10223-1openSUSE-SU-2026:10206-1
- python3 AlmaLinux 10 3.12.13-2.el10_2
- python3-idle AlmaLinux 10 3.12.13-2.el10_2
- python3-libs AlmaLinux 10 3.12.13-2.el10_2
- python3-test AlmaLinux 10 3.12.13-2.el10_2
- python3-tkinter AlmaLinux 10 3.12.13-2.el10_2
- python-unversioned-command AlmaLinux 10 3.12.13-2.el10_2
- python3.12 AlmaLinux 9 3.12.13-2.el9_8
- python3.12-idle AlmaLinux 9 3.12.13-2.el9_8
almalinux advisories ALSA-2026:19064ALSA-2026:19177ALSA-2026:10950
- python3.12 Rocky Linux 10 3.12.13-2.el10_2
- python3.12 Rocky Linux 9 3.12.13-2.el9_8
- python3.12 Rocky Linux 8 3.12.13-2.el8_10
rocky linux advisories RLSA-2026:19064RLSA-2026:19177RLSA-2026:10950
- python3 Azure Linux 3.0 3.12.9-8
- python3 CBL-Mariner 2.0 3.9.19-18
azure linux advisories AZL-75026AZL-75044
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- github.com/python/cpython@95746b3 commit
- github.com/python/cpython@712452e commit
- github.com/python/cpython@6270010 commit
- github.com/python/cpython@7852d72 commit
- github.com/python/cpython@918387e commit
- github.com/python/cpython@b1869ff commit
- github.com/python/cpython#143920 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-0672 updated cvss 4.8
cpython: Header injection in http.cookies.Morsel in Python
-
Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, firefox, python3, tkinter, python-libs, python-test, +5 more Red Hat Enterprise Linux 8 numpy, scipy, PyYAML, firefox, python3, mod_wsgi, +84 more Red Hat Enterprise Linux 9 firefox, python3, python3.9, python3.11, python3.14, firefox-x11, +18 more Red Hat Enterprise Linux 10 firefox, python3.14 Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/bootc-azure-cuda-rhel9affected: workaround, no fix available “Fix deferred”
-
Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel9under investigation
-
Red Hat Enterprise Linux AppStream (v. 8) python3.12 3.12.13-2.el8_10, python3.12-libs 3.12.13-2.el8_10, python3.12-tkinter 3.12.13-2.el8_10, python3.12-rpm-macros 3.12.13-2.el8_10fixed: vendor fix RHSA-2026:10950
-
Red Hat Enterprise Linux AppStream (v. 9) python3.12 3.12.13-2.el9_8, python3.12-libs 3.12.13-2.el9_8, python3.12-tkinter 3.12.13-2.el9_8fixed: vendor fix RHSA-2026:19177
-
Red Hat Enterprise Linux AppStream (v. 10) python3-tkinter 3.12.13-2.el10_2, python-unversioned-command 3.12.13-2.el10_2 Red Hat Enterprise Linux BaseOS (v. 10) python3 3.12.13-2.el10_2, python3.12 3.12.13-2.el10_2, python3-libs 3.12.13-2.el10_2fixed: vendor fix RHSA-2026:19064
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.12 3.12.13-2.el9_8, python3.12-idle 3.12.13-2.el9_8, python3.12-test 3.12.13-2.el9_8, python3.12-tkinter 3.12.13-2.el9_8fixed: vendor fix RHSA-2026:19177
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-idle 3.12.13-2.el10_2, python3-test 3.12.13-2.el10_2fixed: vendor fix RHSA-2026:19064
-
Red Hat Enterprise Linux CRB (v. 8) python3.12 3.12.13-2.el8_10, python3.12-idle 3.12.13-2.el8_10, python3.12-test 3.12.13-2.el8_10, python3.12-tkinter 3.12.13-2.el8_10fixed: vendor fix RHSA-2026:10950
show 2 moreshow fewer
-
Red Hat Update Infrastructure 5 rhui5/rhua-rhel9 1779798222, rhui5/rhua-tp-rhel9 1787241260, rhui5/installer-rhel9 1779798165, rhui5/installer-tp-rhel9 1787135742fixed: vendor fix RHSA-2026:21275
-
Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1779798159, rhui5/cds-tp-rhel9 1787241206, rhui5/haproxy-rhel9 1779798164, rhui5/cds-kubernetes-tp-rhel9 1787241211not affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | libpython | <3.10.20 >=3.11.0, <3.11.15 >=3.12.0, <3.12.13 >=3.13.0, <3.13.12 >=3.14.0, <3.14.3 |
3.10.20 3.11.15 3.12.13 3.13.12 3.14.3 |
| bitnami | python | <3.10.20 >=3.11.0, <3.11.15 >=3.12.0, <3.12.13 >=3.13.0, <3.13.12 >=3.14.0, <3.14.3 |
3.10.20 3.11.15 3.12.13 3.13.12 3.14.3 |
| bitnami | python-min | <3.10.20 >=3.11.0, <3.11.15 >=3.12.0, <3.12.13 >=3.13.0, <3.13.12 >=3.14.0, <3.14.3 |
3.10.20 3.11.15 3.12.13 3.13.12 3.14.3 |
Affected products
- Python Software Foundation CPython
Classification
- Weakness
-
- CWE-93 Improper Neutralization of CRLF Sequences
References
-
github.com
/python/cpython/pull/143920
patch, web
-
github.com
/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70
patch, web
-
github.com
/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440
patch, web
-
github.com
/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172
patch, web
-
github.com
/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d
patch, web
-
github.com
/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca
patch, web
-
github.com
/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85
patch, web
-
mail.python.org
/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/
vendor-advisory, web
-
github.com
/python/cpython/issues/143919
issue-tracking, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-0672
web
Sources
- CVE List CVE-2026-0672
- NVD CVE-2026-0672
- OSV BIT-libpython-2026-0672
- OSV BIT-python-2026-0672
- OSV BIT-python-min-2026-0672
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.