Vulnerability · Published Jan 20, 2026 · Assigned by PSF
CVE-2026-0672Header injection in http.cookies.Morsel
Medium 6.0
In plain English
A medium-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)6.0Medium
Exploit odds (30 days)0.5%top 58.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | python-unversioned-command | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:10 | python3 | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:10 | python3-debug | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:10 | python3-devel | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:10 | python3-idle | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:10 | python3-libs | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:10 | python3-test | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:10 | python3-tkinter | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:8 | python3.12 | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12 | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:8 | python3.12-debug | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12-debug | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:8 | python3.12-devel | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12-devel | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:8 | python3.12-idle | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12-idle | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:8 | python3.12-libs | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12-libs | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:8 | python3.12-rpm-macros | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:8 | python3.12-test | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12-test | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:8 | python3.12-tkinter | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12-tkinter | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2026-0672 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2026-0672 |
| Debian:14 | pypy3 | 7.3.21+dfsg-1 | DEBIAN-CVE-2026-0672 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u7 | DEBIAN-CVE-2026-0672 |
| Debian:13 | python3.13 | 3.13.5-2+deb13u1 | DEBIAN-CVE-2026-0672 |
| Debian:14 | python3.14 | 3.14.3-1 | DEBIAN-CVE-2026-0672 |
| Rocky Linux:10 | python3.12 | 0:3.12.13-2.el10_2 | RLSA-2026:19064 |
| Rocky Linux:8 | python3.12 | 0:3.12.13-2.el8_10 | RLSA-2026:10950 |
| Rocky Linux:9 | python3.12 | 0:3.12.13-2.el9_8 | RLSA-2026:19177 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.14 | UBUNTU-CVE-2026-0672 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.16 | USN-8509-1 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.15 | USN-8509-1 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.11 | UBUNTU-CVE-2026-0672 |
| Ubuntu:25.10 | python3.13 | 3.13.7-1ubuntu0.3 | UBUNTU-CVE-2026-0672 |
| Ubuntu:25.10 | python3.14 | 3.14.0-1ubuntu0.2 | UBUNTU-CVE-2026-0672 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.4-1ubuntu0.1 | USN-8509-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.203.11.0 – before 3.11.153.12.0 – before 3.12.133.13.0 – before 3.13.123.14.0 – before 3.14.33.15.0a1 – before 3.15.0a6 |
Weakness: CWE-93 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/python/cpython/pull/143920 patch
- https://github.com/python/cpython/issues/143919 issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/ vendor-advisory
- https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70 patch
- https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440 patch
- https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172 patch
- https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d patch
- https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca patch
- https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85 patch