Miss Islington (bot) d16ecc6c36 [3.13] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) (#146024) ...

gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600)

Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`.
(cherry picked from commit 57e88c1cf9)

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

2026-03-16 14:05:13 +00:00

..

__init__.py

…

client.py

[3.13] gh-119451: Fix a potential denial of service in http.client (GH-119454) (#142139)

2025-12-05 16:21:57 +01:00

cookiejar.py

[3.13] gh-130631: Make join_header_words() more similar to the original Perl version (GH-130632) (GH-132303)

2025-04-09 09:18:31 +00:00

cookies.py

[3.13] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) (#146024)

2026-03-16 14:05:13 +00:00

server.py

[3.13] gh-119452: Fix a potential virtual memory allocation denial of service in http.server (GH-142216) (#142296)

2025-12-05 15:37:09 +00:00