CVE-2026-3644General(python / python)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch python python systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

python CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

https://mail.python.org/archives/list/[email protected]/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/

Other references

Weakness type (CWE)

CWE-20CWE-116

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

python

Threat summary

Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
General: 3 classified signals
Disclosure: 2 classified signals
Peaked 3d ago at 2 mentions (2026-03-16); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

python

Products

python

1 version affected across 1 product

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

General

350.0%

Disclosure

233.3%

Patch

116.7%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-16	2	Disclosure1General1
2026-03-17	2	Disclosure1General1
2026-04-17	1	General1
2026-04-18	1	Patch1

Full discourse6 posts

Open Source Security mailing list@oss_security206d
Disclosure
CVE-2026-4224: CPython: Stack overflow parsing XML with deeply nested DTD content models https://www.openwall.com/lists/oss-security/2026/03/16/4 CVE-2026-3644: CPython: Incomplete control character validation in http.cookies https://www.openwall.com/lists/oss-security/2026/03/16/5
Post summary
Two newly disclosed CPython vulnerabilities are listed with technical details, but no PoC, exploit, patch, or active exploitation is discussed.
02095842
4.4K followersView on X
Lambda Watchdog@LambdaWatchdog173d
Patch
🔍 Lambda Watchdog detected that CVE-2026-3644 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/455 #AWS #Lambda #Security #CVE #DevOps #SecOps
Post summary
AWS Lambda base images have been updated to remove CVE-2026-3644, with no evidence of current exploitation. The post signals that the CVE has been patched or otherwise eliminated in the latest scans.
0000039
31 followersView on X
Lambda Watchdog@LambdaWatchdog174d
General
🔍 Lambda Watchdog detected that CVE-2026-3644 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/455 #AWS #Lambda #Security #CVE #DevOps #SecOps
Post summary
The tweet reports that CVE‑2026‑3644 is absent from recent AWS Lambda base image scans, linking to a related GitHub issue, without providing any exploit, patch, or technical details.
0000019
34 followersView on X
CVE@CVEnew206d
General
CVE-2026-3644 The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not pat… https://www.cve.org/CVERecord?id=CVE-2026-3644
Post summary
The passage highlights a technical issue with the incomplete fix of CVE-2026-0672 and references CVE-2026-3644, yet it offers no proof of exploitation, PoC, or patch information.
00000104
56.7K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash206d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-3644 - Incomplete control character validation in http.cookies Intel Report: https://ift.tt/NrDJGhI
Post summary
The alert announces CVE-2026-3644, noting incomplete control character validation in HTTP cookies, but provides no PoC, exploit, or patch details.
0000048
335 followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash206d
General
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-3644 - Incomplete control character validation in http.cookies Intel Report: https://ift.tt/iZwMHso
Post summary
The alert references CVE‑2026‑3644 with a brief technical description but offers no evidence of active exploitation, PoC, or patch availability.
0000041
335 followersView on X

CPE platform detail8 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

8 of 8 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	python	python	-	-	-
App	python	python	3.15.0	-	-
App	python	python	3.15.0	-	-
App	python	python	3.15.0	-	-
App	python	python	3.15.0	-	-
App	python	python	3.15.0	-	-
App	python	python	3.15.0	-	-
App	python	python	3.15.0	-	-

Explore more

Back to dashboard python CVEs python vulnerabilities

What researchers are saying

CVE-2026-3644

Open Source Security mailing list@oss_securityDisclosure

Two newly disclosed CPython vulnerabilities are listed with technical details, but no PoC, exploit, patch, or active exploitation is discussed.

Lambda Watchdog@LambdaWatchdogPatch

AWS Lambda base images have been updated to remove CVE-2026-3644, with no evidence of current exploitation. The post signals that the CVE has been patched or otherwise eliminated in the latest scans.

Lambda Watchdog@LambdaWatchdogGeneral

The tweet reports that CVE‑2026‑3644 is absent from recent AWS Lambda base image scans, linking to a related GitHub issue, without providing any exploit, patch, or technical details.

CVE@CVEnewGeneral

The passage highlights a technical issue with the incomplete fix of CVE-2026-0672 and references CVE-2026-3644, yet it offers no proof of exploitation, PoC, or patch information.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The alert announces CVE-2026-3644, noting incomplete control character validation in HTTP cookies, but provides no PoC, exploit, or patch details.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashGeneral

The alert references CVE‑2026‑3644 with a brief technical description but offers no evidence of active exploitation, PoC, or patch availability.