CVE-2026-16052 · Runtime
NO FIX YET
Python's http.cookies.Morsel class writes semicolons inside attribute values verbatim into cookie output. An attacker who controls those values could add or change attributes such as Domain or SameSite, weakening the cookie's restrictions.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use Python's http.cookies module to build Set-Cookie headers and put untrusted input into attribute values. Code that sets cookies only from fixed values, or that does not use Morsel, is unlikely to be exposed. The sources do not name the affected Python versions.
Not affected if fixed-cookie-values, no-morsel-usage
Who cares python, web-apps
python3 --version to see whether the runtime is a Python release covered by the advisoryhttp.cookies or Morsel to find code that sets cookie attributes from user-controlled inputNo fix yet, per the sources.
The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.