Miss Islington (bot) 62ceb396fc [3.14] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) (#146023) ...

gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600)

Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`.
(cherry picked from commit 57e88c1cf9)

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

2026-03-16 14:13:19 +00:00

..

__init__.py

…

client.py

[3.14] gh-119451: Fix a potential denial of service in http.client (GH-119454) (#142138)

2025-12-01 20:34:09 +02:00

cookiejar.py

…

cookies.py

[3.14] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) (#146023)

2026-03-16 14:13:19 +00:00

server.py

[3.14] gh-119452: Fix a potential virtual memory allocation denial of service in http.server (GH-142216)

2025-12-05 16:20:23 +02:00