{"id":"CVE-2026-16052","kind":"vulnerability","aliases":["CVE-2026-16052"],"related":[],"title":"Python: cookie attribute values with semicolons can relax cookie restrictions","description":"The http.cookies.Morsel class allows separator semicolons in attribute\nvalues\nand includes them verbatim in all output formats. An attacker who can\ncontrol\nthese values could use this to relax the cookie's Domain or SameSite\nrestrictions.","summary":"Python's http.cookies.Morsel class writes semicolons inside attribute values verbatim into cookie output. An attacker who controls those values could add or change attributes such as Domain or SameSite, weakening the cookie's restrictions.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["python","runtime","web-apps"],"not_affected_if":["fixed-cookie-values","no-morsel-usage"],"how_to_check":"- `python3 --version` to see whether the runtime is a Python release covered by the advisory\n- Search the codebase for `http.cookies` or `Morsel` to find code that sets cookie attributes from user-controlled input","fix":null,"status":"open","published_at":"2026-11-12T17:17:44+00:00","first_seen_at":"2026-11-12T17:39:39+00:00","triaged_at":"2026-11-12T17:40:06+00:00","updated_at":"2026-11-12T17:40:06+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-12T17:40:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Python: cookie attribute values with semicolons can relax cookie restrictions","impact":"low","summary":"Python's http.cookies.Morsel class writes semicolons inside attribute values verbatim into cookie output. An attacker who controls those values could add or change attributes such as Domain or SameSite, weakening the cookie's restrictions.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["python","web-apps"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Cookie Domain or SameSite restrictions can be weakened by injected attributes","analyst_note":"Confirm affected and fixed Python versions from the Python security-announce post and the NVD entry.","how_to_check":"- `python3 --version` to see whether the runtime is a Python release covered by the advisory\n- Search the codebase for `http.cookies` or `Morsel` to find code that sets cookie attributes from user-controlled input","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-cookie-values","no-morsel-usage"],"who_is_affected":"Applications that use Python's http.cookies module to build Set-Cookie headers and put untrusted input into attribute values. Code that sets cookies only from fixed values, or that does not use Morsel, is unlikely to be exposed. The sources do not name the affected Python versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000725,"input_tokens":4589,"output_tokens":532,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-16052':13A,16A '-2026':12A,15A 'add':42B 'allow':59C 'app':21B 'attack':36B,74C 'attribut':3A,29B,45B,63C 'chang':44B 'class':25B,58C 'control':38B,77C 'cooki':2A,9A,33B,53B,86C 'could':41B,80C 'cve':11A,14A 'domain':48B,88C 'format':72C 'http.cookies.morsel':24B,57C 'includ':66C 'insid':28B 'output':34B,71C 'python':1A,17B,22B 'relax':8A,84C 'restrict':10A,55B,91C 'runtim':18B 'samesit':50B,90C 'semicolon':6A,27B,61C 'separ':60C 'use':81C 'valu':4A,30B,40B,64C,79C 'verbatim':31B,68C 'weaken':51B 'web':20B 'web-app':19B 'write':26B","nicknames":[],"mitigations":[],"who_affected":"Applications that use Python's http.cookies module to build Set-Cookie headers and put untrusted input into attribute values. Code that sets cookies only from fixed values, or that does not use Morsel, is unlikely to be exposed. The sources do not name the affected Python versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","python","runtime","webapps"],"campaign_type":null,"search_a":"'-16052':13A,16A '-2026':12A,15A 'attribut':3A 'cooki':2A,9A 'cve':11A,14A 'python':1A 'relax':8A 'restrict':10A 'semicolon':6A 'valu':4A","search_b":"'add':42B 'app':21B 'attack':36B 'attribut':29B,45B 'chang':44B 'class':25B 'control':38B 'cooki':33B,53B 'could':41B 'domain':48B 'http.cookies.morsel':24B 'insid':28B 'output':34B 'python':17B,22B 'restrict':55B 'runtim':18B 'samesit':50B 'semicolon':27B 'valu':30B,40B 'verbatim':31B 'weaken':51B 'web':20B 'web-app':19B 'write':26B","search_c":"'allow':59C 'attack':74C 'attribut':63C 'class':58C 'control':77C 'cooki':86C 'could':80C 'domain':88C 'format':72C 'http.cookies.morsel':57C 'includ':66C 'output':71C 'relax':84C 'restrict':91C 'samesit':90C 'semicolon':61C 'separ':60C 'use':81C 'valu':64C,79C 'verbatim':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T16:07:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@python.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16052","severity":null,"published_at":"2026-11-12T17:17:44+00:00","modified_at":"2026-11-12T17:17:44+00:00","first_seen_at":"2026-11-12T17:39:39+00:00","fetched_at":"2026-11-12T17:39:39+00:00","note":null}],"documents":[{"id":136271,"url":"https://mail.python.org/archives/list/security-announce@python.org/message/IZL4QUFV7PKGT2JYSU2DCBMLTWYJDGKZ/","title":"Python security-announce: [Security-announce][CVE-2026-16052] Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel","kind":"advisory","source":"advisory","publisher":null,"text":"[Security-announce][CVE-2026-16052] Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel\n\nThere is a LOW severity vulnerability affecting CPython. The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-16052 * https://github.com/python/cpython/pull/161711","published_at":"2026-11-12T16:07:16+00:00","relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}