Detections
Analytics

CVE-2026-16052

low

Description

The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.

References

https://mail.python.org/archives/list/[email protected]/thread/IZL4QUFV7PKGT2JYSU2DCBMLTWYJDGKZ/

https://github.com/python/cpython/pull/161711

https://github.com/python/cpython/issues/161707

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124537

Details

Source: Mitre, NVD

Published: 2026-11-12

Updated: 2026-11-12

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical

CVSS v4

Base Score: 2.3

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Severity: Low

EPSS

EPSS: 0.00305