CVE-2026-0672

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-01-20 cna@python.org

Code Injection

Lifecycle Timeline

Patch released

Mar 19, 2026 - 11:15 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 20, 2026 - 22:15 nvd

N/A

DescriptionCVE.org

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

Analysis

Technical ContextAI

Affected ProductsAI

When using http.cookies.Morsel, user-controlled cookie values and parameters can

RemediationAI

Monitor vendor advisories for a patch.

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all

CVE-2016-3115 MEDIUM POC

6.4

CVE-2021-39172 HIGH POC

8.8

CVE-2026-23953 HIGH POC

8.7

CVE-2024-45302 HIGH POC

7.8

CVE-2017-5868 MEDIUM POC

6.1

CVE-2026-21428 HIGH POC

7.5

CVE-2022-0666 HIGH POC

7.5

CVE-2019-10678 HIGH POC

7.5

Same technique Code Injection

View all

CVE-2012-0158 HIGH POC

8.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

CVE-2025-47812 CRITICAL POC

10.0

CVE-2013-3906 HIGH POC

7.8

CVE-2017-9822 HIGH POC

8.8

CVE-2018-1273 CRITICAL POC

9.8

CVE-2026-0672 vulnerability details – vuln.today

Back