gh-145599: Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output` by StanFromIreland · Pull Request #145600 · python/cpython · GitHub

Issue: Reject control characters in more places in http.cookies.Morsel #145599

One small comment, otherwise LGTM. Thank you!

Co-authored-by: Victor Stinner <vstinner@python.org>

Are you sure about the CVE number?

This one has been reserved for it, see the sidebar of the GHSA.

Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

LGTM. Thanks for the updates.

…okies.Morsel.update()` (pythonGH-145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. (cherry picked from commit 57e88c1) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

GH-146023 is a backport of this pull request to the 3.14 branch.

…okies.Morsel.update()` (pythonGH-145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. (cherry picked from commit 57e88c1) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

GH-146024 is a backport of this pull request to the 3.13 branch.

…okies.Morsel.update()` (pythonGH-145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. (cherry picked from commit 57e88c1) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

Sorry, @StanFromIreland and @vstinner, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 57e88c1cf95e1481b94ae57abe1010469d47a6b4 3.10

GH-146025 is a backport of this pull request to the 3.12 branch.

GH-146026 is a backport of this pull request to the 3.11 branch.

…okies.Morsel.update()` (python#145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com> (cherry picked from commit 57e88c1)

GH-146027 is a backport of this pull request to the 3.10 branch.

Merged, thanks for your fix @StanFromIreland.

Are you sure about the CVE number?

This one has been reserved for it, see the sidebar of the GHSA.

Are you talking about https://github.com/python/cpython/security/advisories ? I don't see CVE 2026-3644 there.

…ookies.Morsel.update()` (GH-145600) (#146024) gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. (cherry picked from commit 57e88c1) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

…ookies.Morsel.update()` (GH-145600) (#146023) gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. (cherry picked from commit 57e88c1) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot AMD64 Arch Linux Usan Function 3.13 (no tier) has failed when building commit d16ecc6.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1601/builds/687) and take a look at the build logs.
Check if the failure is related to this commit (d16ecc6) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1601/builds/687

Failed tests:

test_urllib2net

Summary of the results of the build (if available):

==

Click to see traceback logs

Note: switching to 'd16ecc6c3626f0e2cc8f08c309c83934e8a979dd'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at d16ecc6c362 [3.13] gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600) (#146024)
Switched to and reset branch '3.13'

make: *** [Makefile:2252: buildbottest] Error 2

Unrelated... (Sky :-/)

Hi! The buildbot AMD64 Arch Linux Usan Function 3.13 (no tier) has failed when building commit d16ecc6.
... test_urllib2net ...

I reported the failure as #140748 (comment) and I created python/buildmaster-config#684 to fix it.

…okies.Morsel.update()` (python#145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

…ookies.Morsel.update()` (#145600) (#146027) * gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (#145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com> (cherry picked from commit 57e88c1) * Update Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> --------- Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

…ookies.Morsel.update()` (GH-145600) (#146026) * gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. (cherry picked from commit 57e88c1) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com> * Update Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> --------- Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

…ookies.Morsel.update()` (GH-145600) (#146025) gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600) Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`. (cherry picked from commit 57e88c1) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

StanFromIreland added 2 commits March 6, 2026 08:00

Patch

87d0887

Blurb

63a3b59

bedevere-app Bot mentioned this pull request Mar 6, 2026

Reject control characters in more places in http.cookies.Morsel #145599

Closed

bedevere-app Bot added the awaiting review label Mar 6, 2026

StanFromIreland requested review from Yhg1s and sethmlarson March 6, 2026 17:04

sethmlarson approved these changes Mar 6, 2026

View reviewed changes

Comment thread Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst Outdated

bedevere-app Bot added awaiting core review and removed awaiting review labels Mar 6, 2026

Seth's review, fix blurb

dce754d

StanFromIreland changed the title gh-145599: Reject control characters in more places in http.cookies.Morsel gh-145599: Reject control characters in http.cookies.Morsel.update() and http.cookies.BaseCookie.js_output Mar 6, 2026

StanFromIreland requested a review from gpshead March 6, 2026 18:08

vstinner reviewed Mar 13, 2026

View reviewed changes

Comment thread Lib/http/cookies.py

vstinner reviewed Mar 13, 2026

View reviewed changes

Comment thread Lib/http/cookies.py

Comment thread Lib/http/cookies.py Outdated

vstinner added the type-security A security issue label Mar 13, 2026

Convert to fstr, move check

bb54e28

Co-authored-by: Victor Stinner <vstinner@python.org>

StanFromIreland requested a review from vstinner March 13, 2026 16:03

StanFromIreland added needs backport to 3.10 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels Mar 13, 2026

Add reference to news entry.

ae804e4

vstinner reviewed Mar 16, 2026

View reviewed changes

StanFromIreland requested a review from vstinner March 16, 2026 11:56

vstinner reviewed Mar 16, 2026

View reviewed changes

Comment thread Lib/http/cookies.py Outdated

Comment thread Lib/http/cookies.py Outdated

StanFromIreland and others added 2 commits March 16, 2026 12:39

Victor's request

ba6713e

Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

Whitespace

ba64349

StanFromIreland requested a review from vstinner March 16, 2026 12:40

vstinner approved these changes Mar 16, 2026

View reviewed changes

bedevere-app Bot removed the awaiting merge label Mar 16, 2026

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Mar 16, 2026

bedevere-app Bot removed the needs backport to 3.13 only security fixes label Mar 16, 2026

miss-islington-app Bot assigned vstinner Mar 16, 2026

bedevere-app Bot removed the needs backport to 3.12 only security fixes label Mar 16, 2026

bedevere-app Bot removed the needs backport to 3.11 only security fixes label Mar 16, 2026

bedevere-app Bot removed the needs backport to 3.10 label Mar 16, 2026

StanFromIreland deleted the cookies branch March 16, 2026 13:50

MeggyCal mentioned this pull request Apr 1, 2026

Revert cookie changes in Python 3.15 aio-libs/aiohttp#11400

Open

               Reject control characters in :class:`http.cookies.Morsel`
               :meth:`~http.cookies.Morsel.update` and
               :meth:`~http.cookies.BaseCookie.js_output`.
+              This addresses :cve:`2026-3644`.

gh-145599: Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output` by StanFromIreland · Pull Request #145600 · python/cpython · GitHub

Repository navigation

gh-145599: Reject control characters in http.cookies.Morsel.update() and http.cookies.BaseCookie.js_output - #145600

gh-145599: Reject control characters in http.cookies.Morsel.update() and http.cookies.BaseCookie.js_output#145600vstinner merged 7 commits intopython:mainpython/cpython:mainfrom StanFromIreland:cookiesStanFromIreland/cpython:cookiesCopy head branch name to clipboard

Conversation

StanFromIreland commented Mar 6, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sethmlarson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vstinner Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

StanFromIreland Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

bedevere-app Bot commented Mar 16, 2026

Uh oh!

bedevere-app Bot commented Mar 16, 2026

Uh oh!

miss-islington-app Bot commented Mar 16, 2026

Uh oh!

bedevere-app Bot commented Mar 16, 2026

Uh oh!

bedevere-app Bot commented Mar 16, 2026

Uh oh!

bedevere-app Bot commented Mar 16, 2026

Uh oh!

vstinner commented Mar 16, 2026

Uh oh!

bedevere-bot commented Mar 16, 2026

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Uh oh!

StanFromIreland commented Mar 16, 2026

Uh oh!

vstinner commented Mar 16, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gh-145599: Reject control characters in http.cookies.Morsel.update() and http.cookies.BaseCookie.js_output#145600
vstinner merged 7 commits into
python:mainfrom
StanFromIreland:cookies

StanFromIreland commented Mar 6, 2026 •
edited by bedevere-app Bot
Loading

StanFromIreland Mar 16, 2026 •
edited
Loading