CVE-2026-3644

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

• CWE-20
• CWE-116

• https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330
• https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8
• https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4Patch
• https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590ddPatch
• https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979ddPatch
• https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef
• https://github.com/python/cpython/issues/145599Issue Tracking
• https://github.com/python/cpython/pull/145600Patch
• https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/Third Party Advisory

Published

Mar 16, 2026

Last Modified

Aug 13, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-36418JimuReport versions 2.3.4 and below are vulnerable to remote…9.1
• CVE-2026-3642The e-shot™ form builder plugin for WordPress is vulnerable …5.3
• CVE-2026-36425An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02…6.5
• CVE-2026-3643The Accessibly plugin for WordPress is vulnerable to Stored …7.2
• CVE-2026-36433An issue in Actions Semiconductor Co. Ltd Tool- Media Player…9.8
• CVE-2026-36438An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0…5.3
• CVE-2026-3645The Punnel – Landing Page Builder plugin for WordPress is vu…5.3
• CVE-2026-36453Rhymix before 2.1.31 allows insecure direct object reference…7.4
• CVE-2026-36458ChestnutCMS v1.5.10 has a SQL injection vulnerability. The c…9.8
• CVE-2026-3646The LTL Freight Quotes – R+L Carriers Edition plugin for Wor…5.3
• CVE-2026-36460Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerab…4.8
• CVE-2026-36467Unrestricted Upload of File with Dangerous Type in core/modu…7.2