cpython/Lib/http
Miss Islington (bot) 673da877d9
[3.12] gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) (#160648)
gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301)

DefaultCookiePolicy only applied its domain checks to cookies with
version 0 or a positive version.

ANT-2026-TA36I7V7
(cherry picked from commit d59d96853b)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
2026-10-25 06:43:46 -07:00
..
__init__.py
client.py [3.12] gh-150743: Limit trailer lines and interim responses read by http.client (GH-150749) (#152527) 2026-08-04 11:27:42 +02:00
cookiejar.py [3.12] gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) (#160648) 2026-10-25 06:43:46 -07:00
cookies.py [3.12] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) (#146025) 2026-08-04 11:16:44 +02:00
server.py [3.12] gh-119452: Fix a potential virtual memory allocation denial of service in http.server (GH-142216) (#142297) 2025-12-15 15:11:38 +01:00