Quadratic complexity parsing cookies with backslashes

CVE-2024-7592

What is CVE-2024-7592?

A performance issue exists in the 'http.cookies' standard library module of CPython that impacts the way cookies are parsed. Specifically, the vulnerability arises when dealing with cookie values that include backslashes for quoted characters. This issue leads to the parser utilizing an algorithm with quadratic complexity, which significantly increases CPU resource consumption during parsing operations. As a result, system performance may degrade under certain conditions, making it important for developers and system administrators to identify affected implementations and apply the necessary patches.

References