ilusha/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython synced 2026-11-06 09:02:40 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions 20
cpython/Lib/http
History
Exact
Miss Islington (bot) dae4b1a21f
[3.11] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) (#146026) 
* gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600)

Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`.
(cherry picked from commit 57e88c1cf9)

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

* Update Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

---------

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Victor Stinner <victor.stinner@gmail.com>
2026-06-28 23:16:33 +01:00
..
__init__.py
client.py [3.11] gh-150743: Limit trailer lines and interim responses read by http.client (GH-150749) (#152528) 2026-06-28 22:50:25 +02:00
cookiejar.py
cookies.py [3.11] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) (#146026) 2026-06-28 23:16:33 +01:00
server.py [3.11] gh-119452: Fix a potential virtual memory allocation denial of service in http.server (GH-142216) (#142298) 2026-01-25 17:10:45 +00:00