CVE-2026-42874

Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.set_cookie() method does not sanitize its string arguments, and in particular will not detect the presence of the \r\n sequence in them. This can be a potential source of header injection attacks. For a header injection attack through this issue to be possible, an attacker must first infiltrate the client (for example through an independent XSS attack), so that it can send malicious information that is destined to be stored in a cookie by the server on behalf of the victim. An attacker that infiltrates one client can only orchestrate a header injection attack for that client, all other clients that were not infiltrated are safe. This vulnerability is fixed in 2.6.1.

• CWE-113

• https://github.com/miguelgrinberg/microdot/blob/main/CHANGES.md
• https://github.com/miguelgrinberg/microdot/commit/99b281b45faef8472410f2d56bfef496dfbd95d5
• https://github.com/miguelgrinberg/microdot/security/advisories/GHSA-7wc8-wvc4-m498

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42869SOCFortress CoPilot focuses on providing a single pane of gl…10
• CVE-2026-4287A security flaw has been discovered in Tiandy Easy7 Integrat…7.3
• CVE-2026-42870WeGIA is a web manager for charitable institutions. In versi…6.4
• CVE-2026-42871WeGIA is a web manager for charitable institutions. In versi…6.9
• CVE-2026-42872WeGIA is a web manager for charitable institutions. In versi…6.1
• CVE-2026-42873WeGIA is a web manager for charitable institutions. In versi…0
• CVE-2026-42875External Secrets Operator reads information from a third-par…5.3
• CVE-2026-42876External Secrets Operator reads information from a third-par…4.9
• CVE-2026-42877FacturaScripts is an open source accounting and invoicing so…5.4
• CVE-2026-42878FacturaScripts is an open source accounting and invoicing so…5.3
• CVE-2026-42879FacturaScripts is an open source accounting and invoicing so…6.3
• CVE-2026-4288A weakness has been identified in Tiandy Easy7 Integrated Ma…7.3