CVE-2026-0672
Public on 2026-01-20
Modified on 2026-01-23
Description
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | python | 2026-03-06 | ALAS2-2026-3185 | Fixed |
| Amazon Linux 2 - Core | python3 | 2026-03-06 | ALAS2-2026-3184 | Fixed |
| Amazon Linux 2023 | python3.11 | 2026-03-05 | ALAS2023-2026-1447 | Fixed |
| Amazon Linux 2023 | python3.12 | 2026-02-18 | ALAS2023-2026-1444 | Fixed |
| Amazon Linux 2023 | python3.13 | 2026-02-18 | ALAS2023-2026-1437 | Fixed |
| Amazon Linux 2023 | python3.9 | Pending Fix |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N |