CVE-2026-3644: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-3644 is an incomplete fix vulnerability in Python's http.cookies module, specifically in the Morsel class, that allows control characters to bypass input validation. It is a follow-on to CVE-2026-0672, which introduced control character rejection in http.cookies.Morsel but left several code paths unpatched: Morsel.update(), the |= operator, and the unpickling (__setstate__) path. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output(). Affected versions include all CPython releases before 3.13.13, versions 3.14.0 through before 3.14.4, and 3.15.0 alpha releases (alpha1–alpha7). The vulnerability was disclosed on March 16, 2026, with a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, CPython Issue).

The root cause is improper input validation (CWE-20) combined with incomplete filtering of special elements (CWE-791) and improper encoding or escaping of output (CWE-116). When the prior fix for CVE-2026-0672 was applied, it only patched certain code paths in http.cookies.Morsel — specifically the direct attribute setter — but omitted validation in Morsel.update(), the __ior__ (|=) operator (which delegates to update()), and the __setstate__ method used during unpickling. Furthermore, BaseCookie.js_output() did not apply the same output-time control character check that BaseCookie.output() used, allowing malicious cookie data to pass through into JavaScript output contexts. An attacker with the ability to influence cookie values processed by a vulnerable Python application can inject C0 control characters (e.g., carriage return \r, line feed \n) through these unguarded paths (CPython Commit, CPython PR).

Successful exploitation allows an attacker to inject control characters into HTTP cookie headers or JavaScript cookie output generated by a Python web application, potentially enabling HTTP response splitting, cookie injection, or script injection in JavaScript contexts via js_output(). The primary impact is on integrity (CVSS v3.1 integrity impact: High), with no direct confidentiality or availability impact. Applications that process attacker-controlled cookie data and subsequently use Morsel.update(), the |= operator, unpickling, or js_output() are at risk of producing malformed or malicious HTTP responses (Red Hat Advisory, Feedly).

1. Identify a target application: Find a Python web application using http.cookies that processes attacker-influenced cookie data and uses Morsel.update(), the |= operator, unpickling of Morsel objects, or BaseCookie.js_output() to generate HTTP responses.
2. Craft a malicious cookie value: Prepare a cookie value containing C0 control characters such as \r\n (carriage return + line feed), which are the characters typically used in HTTP response splitting attacks.
3. Inject via an unguarded code path: Submit the malicious value through an application endpoint that triggers one of the unpatched paths — for example, by sending a request that causes the application to call morsel.update({'path': '<CR><LF>injected-header: value'}) or use the |= operator with attacker-controlled data.
4. Trigger js_output() for script injection: If the application calls BaseCookie.js_output() to embed cookie data in a JavaScript context, the injected control characters bypass output validation, potentially enabling script injection in the rendered page.
5. Achieve objective: Depending on the application's behavior, the attacker may achieve HTTP response splitting (injecting arbitrary HTTP headers or body content), cookie injection (setting unauthorized cookies in a victim's browser), or JavaScript injection in pages using js_output() (CPython Commit, CPython Issue).

Update CPython to a patched version: 3.13.13 or later (for the 3.13 branch), 3.14.4 or later (for the 3.14 branch), or a release incorporating the fix for 3.10, 3.11, and 3.12 branches via the respective backport commits. The fix adds control character validation to Morsel.update(), the __ior__ (|=) operator, the __setstate__ (unpickling) path, and BaseCookie.js_output(). Linux distribution packages (Red Hat, SUSE, Debian, Amazon Linux, Fedora, openSUSE) have released updated packages incorporating this fix. The Red Hat bugzilla ticket 2448168 tracks the fix for RHEL-based systems (Red Hat Advisory, CPython PR, Red Hat Bugzilla).

The fix was contributed by community member StanFromIreland and reviewed and merged by CPython core developer Victor Stinner on March 16, 2026. During the review, Stinner initially questioned the CVE number assignment, which was clarified by the contributor referencing the associated GitHub Security Advisory (GHSA-vf33-88pf-hwp3). The vulnerability received broad downstream attention, with patches quickly backported to Python 3.10 through 3.14 and picked up by major Linux distributions including Red Hat, SUSE, Debian, Fedora, and Amazon Linux (CPython PR, oss-sec).