CVE-2026-0672: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-0672 is a CRLF injection vulnerability in Python's http.cookies.Morsel class that allows user-controlled cookie names, values, and parameters to inject arbitrary HTTP headers into messages. It affects CPython versions prior to 3.15.0 (including actively maintained branches 3.10 through 3.14) and was disclosed on January 20, 2026, by the Python Software Foundation (PSF). The vulnerability carries a CVSS v4.0 base score of 6.0 (Medium) (Feedly, EUVD).

The root cause is improper neutralization of CRLF sequences (CWE-93) in the http.cookies.Morsel class within Python's standard library. Prior to the fix, the Morsel.__setitem__(), Morsel.setdefault(), Morsel.set(), and SimpleCookie.output() methods did not validate cookie names, values, or parameters for C0 control characters (Unicode range \x00-\x1F and \x7F), including carriage return (\r) and line feed (\n). An attacker with the ability to influence cookie values passed to these methods — for example, via user-supplied input in a web application — could embed CRLF sequences to inject additional HTTP headers into server responses. The fix adds a _has_control_character() helper using the regex [\x00-\x1F\x7F] and raises a CookieError if any control character is detected (CPython PR #143920, CPython commit 95746b3).

Successful exploitation enables HTTP response splitting and header injection attacks, which can lead to session hijacking, cache poisoning, cross-site scripting via injected headers, and web log tampering. The integrity impact is rated High (attacker can manipulate HTTP response structure), while confidentiality impact is Low (limited information disclosure). Availability is not directly affected. The vulnerability is network-exploitable and requires low privileges, but attack requirements (user-controlled input reaching http.cookies.Morsel) must be present (Feedly, EUVD).

1. Identify target: Find a Python web application using http.cookies.Morsel (or SimpleCookie) that accepts user-controlled input for cookie names, values, or parameters without prior sanitization.
2. Craft malicious input: Prepare a cookie value or parameter containing CRLF sequences, e.g., legitimate_value\r\nInjected-Header: malicious-content.
3. Submit the payload: Send an HTTP request to the application with the crafted input in a field that gets passed to Morsel.set(), Morsel.__setitem__(), or Morsel.setdefault().
4. Trigger header injection: The application processes the cookie and calls SimpleCookie.output() or similar, embedding the injected CRLF sequence into the HTTP response headers.
5. Achieve objective: The injected header appears in the HTTP response, enabling response splitting, cache poisoning, or session hijacking depending on the downstream infrastructure (CPython Issue #143919, CPython PR #143920).

• Network: HTTP responses from the application containing unexpected or duplicate headers (e.g., Set-Cookie headers with embedded newlines, or injected headers like Location, Content-Type, or custom headers not set by the application).
• Logs: Web server access logs showing requests with URL-encoded or raw CRLF sequences (%0d%0a, %0D%0A, \r\n) in cookie-related parameters or POST body fields.
• Application: Python application logs showing CookieError: Control characters are not allowed in cookies exceptions (on patched versions), which may indicate attempted exploitation.
• Network: Anomalous HTTP response splitting artifacts observed in proxy or WAF logs, such as responses with unexpected body content appearing as headers.

The Python Software Foundation released patches for all actively maintained branches: CPython 3.10, 3.11, 3.12, 3.13, and 3.14 (backported via PRs #144089–#144094), with the fix merged to main on January 20, 2026 (commit 95746b3). Downstream distributions including Debian, Ubuntu (USN-8018-1, USN-8018-2, USN-8018-3), SUSE, Fedora, Amazon Linux 2, Amazon Linux 2023, Red Hat Enterprise Linux, and AlmaLinux have released updated packages. Users should upgrade to the latest patched Python release for their branch. As a workaround, applications should sanitize all user-supplied input before passing it to http.cookies.Morsel, explicitly rejecting any strings containing control characters (\x00-\x1F, \x7F) (CPython PR #143920, Debian LTS, Ubuntu USN-8018-1).

The fix was authored by Seth Michael Larson (PSF Security Developer-in-Residence) and reviewed by multiple CPython core developers, reflecting a well-coordinated disclosure and patch process. The Python security announcement was published to the security-announce@python.org mailing list and the oss-security list. Downstream Linux distributions responded promptly with security advisories and package updates across Debian, Ubuntu, SUSE, Fedora, Red Hat, and Amazon Linux. No significant controversy or notable social media discussion beyond routine security update announcements was observed (Python Security Announce, oss-sec).