Description
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Remediation
References
Related Vulnerabilities
Internet Information Services CVE-2001-0146 Vulnerability (CVE-2001-0146)
PostgreSQL Insufficiently Protected Credentials Vulnerability (CVE-2021-23222)
Grafana Uncontrolled Resource Consumption Vulnerability (CVE-2026-33382)
WordPress Plugin Kish Guest Posting 'uploadify.php' Arbitrary File Upload (1.2)