« Volver al listado

CVE-2026-3644

Estado: ModificadaMedia (6)—

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Python — Python

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-3644",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-3644",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-16T18:25:27.051552Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@python.org",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@python.org",
      "affectedData": [
        {
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "modules": [
            "http.cookies"
          ],
          "product": "CPython",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.10.21",
              "versionType": "python"
            },
            {
              "status": "affected",
              "version": "3.11.0",
              "lessThan": "3.11.16",
              "versionType": "python"
            },
            {
              "status": "affected",
              "version": "3.12.0",
              "lessThan": "3.12.14",
              "versionType": "python"
            },
            {
              "status": "affected",
              "version": "3.13.0",
              "lessThan": "3.13.13",
              "versionType": "python"
            },
            {
              "status": "affected",
              "version": "3.14.0",
              "lessThan": "3.14.4",
              "versionType": "python"
            },
            {
              "status": "affected",
              "version": "3.15.0a1",
              "lessThan": "3.15.0a8",
              "versionType": "python"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-16T18:16:09.907",
  "references": [
    {
      "url": "https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4",
      "tags": [
        "Patch"
      ],
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd",
      "tags": [
        "Patch"
      ],
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd",
      "tags": [
        "Patch"
      ],
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/issues/145599",
      "tags": [
        "Issue Tracking"
      ],
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/pull/145600",
      "tags": [
        "Patch"
      ],
      "source": "cna@python.org"
    },
    {
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cna@python.org"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output()."
    },
    {
      "lang": "es",
      "value": "La solución para CVE-2026-0672, que rechazaba caracteres de control en http.cookies.Morsel, era incompleta. Los métodos Morsel.update(), el operador |= y las rutas de deserialización no fueron parcheados, permitiendo que los caracteres de control eludieran la validación de entrada. Además, BaseCookie.js_output() carecía de la validación de salida aplicada a BaseCookie.output()."
    }
  ],
  "lastModified": "2026-08-13T01:16:53.120",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74460139-CF2A-457B-82B4-7B655FB576B1",
              "versionEndExcluding": "3.13.13"
            },
            {
              "criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA3B34C3-1E02-4674-8370-0DD4D24DBE58",
              "versionEndExcluding": "3.14.4",
              "versionStartIncluding": "3.14.0"
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3327507-0B1D-4F28-A983-D07A2C8A7696"
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8AF17F1-A27F-4C98-BA5A-B4319710E8D1"
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24CF56B0-2F4E-42A2-B655-F493AA0A4815"
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7184ABBA-B100-489E-B5C1-1C9EEC0546CA"
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6D4181B-3E1B-499B-AAB1-50868A6A6AD3"
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A52F6DD2-717D-4E8C-8DB7-00890BC1ABAE"
            },
            {
              "criteria": "cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C46C55C-801E-4F86-B669-8E6A12B4AB6F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@python.org"
}