Security readout for executives and security teams
Plain-English summary
CPython’s cookie-handling library can accept control characters through several paths missed by an earlier fix. In applications that let a low-privileged or otherwise positioned attacker influence cookie objects, this could corrupt generated cookie or JavaScript output and materially affect integrity. Impact depends on how the application constructs, updates, restores, and emits cookies.
Executive priority
Treat this as a moderate-priority integrity issue. Prioritize internet-facing applications that generate cookies from user-controlled data, deserialize cookie objects, or use JavaScript cookie output. Patch during the next expedited maintenance window after confirming affected versions; accelerate remediation where cookies influence authentication, authorization, or other security-sensitive behavior.
Technical view
The CVE-2026-0672 fix did not cover Morsel.update(), the |= operator, or unpickling. BaseCookie.js_output() also lacked BaseCookie.output() validation. These gaps permit control characters to bypass expected validation. CVSS 4.0 is 6.0, reflecting network reachability, low complexity, a prerequisite condition, low privileges, and potentially high integrity impact.
Likely exposure
Exposure is most likely where affected CPython versions process attacker-influenced cookie values through Morsel updates, merge operators, deserialization, or js_output(). The bundle lists CPython 3.11 through 3.15.0a1, but does not provide precise affected ranges or fixed release numbers; confirm applicability against the vendor advisory.
Exploitation context
The bundle does not identify known active exploitation, and the CVE is not listed as KEV. Exploitation requires a prerequisite condition and low privileges according to the supplied CVSS vector. Practical risk depends on whether an attacker can influence the vulnerable cookie-processing paths and whether their output reaches a security-sensitive response.
Researcher notes
This is an incomplete-fix vulnerability spanning multiple alternate mutation and output paths. Review each path independently because testing only direct Morsel assignment or BaseCookie.output() may produce false assurance. The supplied version data is ambiguous and defaults unspecified versions to unaffected, so branch-specific vendor confirmation is necessary before declaring exposure or remediation complete.
Mitigation direction
- Upgrade to a vendor-confirmed fixed CPython release for the deployed branch.
- Follow the Python security advisory for branch-specific remediation guidance.
- Avoid deserializing untrusted cookie or Morsel pickle data.
- Validate cookie names and values before update, merge, or JavaScript output paths.
Validation and detection
- Inventory deployed CPython versions and compare them with the vendor advisory.
- Search application code for Morsel.update(), |=, unpickling, and BaseCookie.js_output() usage.
- Trace whether untrusted input can reach identified cookie-processing paths.
- Confirm patched deployments reject control characters across every affected path.
- Run relevant application regression tests after updating CPython.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-116: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-3644 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N——PSFVulnerability scoring details
Base CVSS 4.0 score
6MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/CVE reference, PSF · vendor-advisory
- https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4CVE reference, PSF · patch
- https://github.com/python/cpython/issues/145599CVE reference, PSF · issue-tracking
- https://github.com/python/cpython/pull/145600CVE reference, PSF · patch
- https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590ddCVE reference, PSF · patch
- https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979ddCVE reference, PSF · patch
- https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8CVE reference, PSF · patch
- https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cefCVE reference, PSF · patch
- https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330CVE reference, PSF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Encoding or Escaping of Output
Improper Encoding or Escaping of Output represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Input Validation
Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.