CVE-2026-16052

CVSS 2.3 (low) · published 2026-11-12

The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.

Weakness: CWE-74

Source: NVD CVE-2026-16052

References

• https://github.com/python/cpython/issues/161707
• https://github.com/python/cpython/pull/161711
• https://mail.python.org/archives/list/[email protected]/thread/IZL4QUFV7PKGT2JYSU2DCBMLTWYJDGKZ/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.