← Vulnerability feed

Vulnerability record · CVE-2026-3644 · published 16 March 2026

CVE-2026-3644: Python improper input validation vulnerability

Python · Python

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

6.0 CVSS 4.0 Medium EPSS 0.54% · top 53.8% CWE-20 · Improper input validationCWE-116 · CWE-116
6.0CVSS 4.0 base score
0.54%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
9References
13 Aug 2026Last modified by NVD

Description

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330
https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8
https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4 Patch
https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd Patch
https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd Patch
https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef
https://github.com/python/cpython/issues/145599 Issue Tracking
https://github.com/python/cpython/pull/145600 Patch
https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/ Third Party Advisory

Track CVE-2026-3644 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-5031Python vulnerabilityMultiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to have an unknown impact via a large integer va…EPSS 3.0%9.8CVE-2022-48565Python xml external entity (xxe) vulnerabilityAn XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist fil…EPSS 5.2%9.8CVE-2022-37454Extended keccak code package project extended keccak code package integer overflow vulnerabilityThe Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute …EPSS 7.4%9.8CVE-2021-29921Python vulnerabilityIn Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) all…EPSS 6.8%9.8CVE-2021-3177Python classic buffer overflow vulnerabilityPython 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applic…EPSS 24%9.8CVE-2020-27619Python vulnerabilityIn Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.EPSS 8.3%9.8CVE-2020-15801Python untrusted search path vulnerabilityIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <execu…EPSS 3.6%9.8CVE-2014-4650Python path traversal vulnerabilityThe CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remo…EPSS 24%

Source: NIST National Vulnerability Database (record CVE-2026-3644), CISA KEV, FIRST EPSS (scores of 2026-11-13). This page is refreshed as NVD updates the record.