gh-145599: Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output` by StanFromIreland · Pull Request #145600 · python/cpython

StanFromIreland · 2026-03-06T17:04:28Z

Issue: Reject control characters in more places in http.cookies.Morsel #145599

sethmlarson

One small comment, otherwise LGTM. Thank you!

Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst

Lib/http/cookies.py

Co-authored-by: Victor Stinner <vstinner@python.org>

vstinner · 2026-03-16T11:00:36Z

Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst

 Reject control characters in :class:`http.cookies.Morsel`
 :meth:`~http.cookies.Morsel.update` and
 :meth:`~http.cookies.BaseCookie.js_output`.
+This addresses :cve:`2026-3644`.


Are you sure about the CVE number?

This one has been reserved for it, see the sidebar of the GHSA.

Lib/http/cookies.py

Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

vstinner

LGTM. Thanks for the updates.

miss-islington-app · 2026-03-16T13:43:48Z

Thanks @StanFromIreland for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

…okies.Morsel.update()` (pythonGH-145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. (cherry picked from commit 57e88c1cf95e1481b94ae57abe1010469d47a6b4) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

bedevere-app · 2026-03-16T13:44:01Z

GH-146023 is a backport of this pull request to the 3.14 branch.

…okies.Morsel.update()` (pythonGH-145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. (cherry picked from commit 57e88c1) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

bedevere-app · 2026-03-16T13:44:05Z

GH-146024 is a backport of this pull request to the 3.13 branch.

…okies.Morsel.update()` (pythonGH-145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. (cherry picked from commit 57e88c1) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

miss-islington-app · 2026-03-16T13:44:09Z

Sorry, @StanFromIreland and @vstinner, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 57e88c1cf95e1481b94ae57abe1010469d47a6b4 3.10

bedevere-app · 2026-03-16T13:44:11Z

GH-146025 is a backport of this pull request to the 3.12 branch.

bedevere-app · 2026-03-16T13:44:15Z

GH-146026 is a backport of this pull request to the 3.11 branch.

…okies.Morsel.update()` (python#145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com> (cherry picked from commit 57e88c1)

bedevere-app · 2026-03-16T13:47:37Z

GH-146027 is a backport of this pull request to the 3.10 branch.

vstinner · 2026-03-16T13:50:13Z

Merged, thanks for your fix @StanFromIreland.

Are you sure about the CVE number?

This one has been reserved for it, see the sidebar of the GHSA.

Are you talking about https://github.com/python/cpython/security/advisories ? I don't see CVE 2026-3644 there.

…ookies.Morsel.update()` (GH-145600) (#146024) gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. (cherry picked from commit 57e88c1) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

…ookies.Morsel.update()` (GH-145600) (#146023) gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. (cherry picked from commit 57e88c1) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

bedevere-bot · 2026-03-16T18:16:31Z

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot AMD64 Arch Linux Usan Function 3.13 (no tier) has failed when building commit d16ecc6.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1601/builds/687) and take a look at the build logs.
Check if the failure is related to this commit (d16ecc6) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1601/builds/687

Failed tests:

test_urllib2net

Summary of the results of the build (if available):

==

Click to see traceback logs

Note: switching to 'd16ecc6c3626f0e2cc8f08c309c83934e8a979dd'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at d16ecc6c362 [3.13] gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600) (#146024)
Switched to and reset branch '3.13'

make: *** [Makefile:2252: buildbottest] Error 2

StanFromIreland added 2 commits March 6, 2026 08:00

Patch

87d0887

Blurb

63a3b59

bedevere-app bot mentioned this pull request Mar 6, 2026

Reject control characters in more places in http.cookies.Morsel #145599

Closed

bedevere-app bot added the awaiting review label Mar 6, 2026

StanFromIreland requested review from Yhg1s and sethmlarson March 6, 2026 17:04

sethmlarson approved these changes Mar 6, 2026

View reviewed changes

Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst Outdated Show resolved Hide resolved

bedevere-app bot added awaiting core review and removed awaiting review labels Mar 6, 2026

Seth's review, fix blurb

dce754d

StanFromIreland changed the title ~~gh-145599: Reject control characters in more places in http.cookies.Morsel~~ gh-145599: Reject control characters in http.cookies.Morsel.update() and http.cookies.BaseCookie.js_output Mar 6, 2026

StanFromIreland requested a review from gpshead March 6, 2026 18:08

vstinner reviewed Mar 13, 2026

View reviewed changes

Lib/http/cookies.py Show resolved Hide resolved

vstinner reviewed Mar 13, 2026

View reviewed changes

Lib/http/cookies.py Show resolved Hide resolved

Lib/http/cookies.py Outdated Show resolved Hide resolved

vstinner added the type-security A security issue label Mar 13, 2026

Convert to fstr, move check

bb54e28

Co-authored-by: Victor Stinner <vstinner@python.org>

StanFromIreland requested a review from vstinner March 13, 2026 16:03

StanFromIreland added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Mar 13, 2026

Add reference to news entry.

ae804e4

vstinner reviewed Mar 16, 2026

View reviewed changes

StanFromIreland requested a review from vstinner March 16, 2026 11:56

vstinner reviewed Mar 16, 2026

View reviewed changes

Lib/http/cookies.py Outdated Show resolved Hide resolved

Lib/http/cookies.py Outdated Show resolved Hide resolved

StanFromIreland and others added 2 commits March 16, 2026 12:39

Victor's request

ba6713e

Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

Whitespace

ba64349

StanFromIreland requested a review from vstinner March 16, 2026 12:40

vstinner approved these changes Mar 16, 2026

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting core review labels Mar 16, 2026

vstinner merged commit 57e88c1 into python:main Mar 16, 2026
51 checks passed

bedevere-app bot removed the awaiting merge label Mar 16, 2026

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Mar 16, 2026

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Mar 16, 2026

miss-islington-app bot assigned vstinner Mar 16, 2026

bedevere-app bot removed the needs backport to 3.12 only security fixes label Mar 16, 2026

bedevere-app bot removed the needs backport to 3.11 only security fixes label Mar 16, 2026

bedevere-app bot removed the needs backport to 3.10 only security fixes label Mar 16, 2026

StanFromIreland deleted the cookies branch March 16, 2026 13:50

Uh oh!

Conversation

StanFromIreland commented Mar 6, 2026 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sethmlarson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vstinner Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

StanFromIreland Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington-app bot commented Mar 16, 2026

Uh oh!

bedevere-app bot commented Mar 16, 2026

Uh oh!

bedevere-app bot commented Mar 16, 2026

Uh oh!

miss-islington-app bot commented Mar 16, 2026

Uh oh!

bedevere-app bot commented Mar 16, 2026

Uh oh!

bedevere-app bot commented Mar 16, 2026

Uh oh!

bedevere-app bot commented Mar 16, 2026

Uh oh!

vstinner commented Mar 16, 2026

Uh oh!

bedevere-bot commented Mar 16, 2026

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

StanFromIreland commented Mar 6, 2026 •

edited by bedevere-app bot

Loading

StanFromIreland Mar 16, 2026 •

edited

Loading