CVE-2026-0672 Header injection in http.cookies.Morsel
Attackers can inject HTTP headers via malicious cookie values in Python's http.cookies module, potentially bypassing security controls or modifying responses.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-0672?
CVE-2026-0672 is a medium-severity vulnerability in CPython, published on 20 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Weakness: CWE-93
Which versions are affected by CVE-2026-0672?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.10.20, 3.11.15, 3.12.13, 3.13.12, 3.14.3 |
python Bitnami | All versions | 3.10.20, 3.11.15, 3.12.13, 3.13.12, 3.14.3 |
python-min Bitnami | All versions | 3.10.20, 3.11.15, 3.12.13, 3.13.12, 3.14.3 |
Linux distribution packages (1)
python-M2Crypto openSUSE:Tumbleweed | All versions | 0.48.0-1.1 |
How do I fix CVE-2026-0672?
Upgrade libpython to a fixed version for your release line: 3.10.20, 3.11.15, 3.12.13 or 3.13.12.
Is CVE-2026-0672 being exploited?
There is no known exploitation of CVE-2026-0672 in the wild and no public exploit code.
Sources
Also known as AZL-75026, AZL-75044, BELL-CVE-2026-0672, BIT-libpython-2026-0672, BIT-python-2026-0672, BIT-python-min-2026-0672 and 10 more.