CVEFinder.io

CVE-2026-3644

âš ī¸ high
🔍 Scan for this CVE
Summary

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

CVSS Score
7.5
High
EPSS Score
0.1
Exploit Probability
Published Date
2026-03-16
First Seen: 2026-03-17
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.9% of all 329,456 vulnerabilities in our database.

#102,448
Above average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Mar 16, 2026
🔍 Exploitation Status
None
No known exploits
âš™ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
🏆 Discovered By
Stan Ulbrych (coordinator) Stan Ulbrych (remediation developer) Victor Stinner (remediation reviewer) Seth Larson (remediation reviewer) Vyom Yadav (reporter)
SSVC data provided by CISA
Last Modified 2026-06-04
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS Vector 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)

đŸ“Ļ Affected Products 3

🔗 References 6

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-7210 âš ī¸ high 7.5 0.8 `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow... 2026-05-11
CVE-2026-3087 âš ī¸ high 7.5 0.2 If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th... 2026-04-27
CVE-2026-6019 đŸ”ļ medium 6.1 0.0 http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It ... 2026-04-22
CVE-2026-4224 âš ī¸ high 7.5 0.1 When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply ... 2026-03-16
CVE-2025-13462 â„šī¸ low 3.3 0.2 The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi... 2026-03-12
CVE-2025-12781 đŸ”ļ medium 5.3 0.0 When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the... 2026-01-21
These CVEs affect the same products