Vulnerability in Python's HTTP Cookies Handling Affects Security of Web Applications
CVE-2026-16052

2.3LOW

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
12 November 2026

What is CVE-2026-16052?

A vulnerability within Python's http.cookies.Morsel class allows malicious actors to include separator semicolons in attribute values of cookies. This could lead to unauthorized access by relaxing a cookie's Domain or SameSite restrictions, potentially compromising the security of web applications that rely on cookie management for user sessions and data integrity.

Affected Version(s)

CPython 0 < 3.16.0

References

https://github.com/python/cpython/pull/161711
https://github.com/python/cpython/issues/161707
https://mail.python.org/archives/list/security-announce@p...

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Qi Deng (https://github.com/ikow)
Stan Ulbrych (https://github.com/StanFromIreland)
Brett Smith (https://github.com/brettcs)
Seth Larson (https://github.com/sethmlarson)
Victor Stinner (https://github.com/vstinner)
Senthil Kumaran (https://github.com/orsenthil)
.