Miss Islington (bot) 673da877d9

[3.12] gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) (#160648) ...

gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301)

DefaultCookiePolicy only applied its domain checks to cookies with
version 0 or a positive version.

ANT-2026-TA36I7V7
(cherry picked from commit d59d96853be8def13cb419d50991af77c0e26330)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

2026-10-25 06:43:46 -07:00

..

__init__.py

…

client.py

[3.12] gh-150743: Limit trailer lines and interim responses read by http.client (GH-150749) (#152527)

2026-08-04 11:27:42 +02:00

cookiejar.py

[3.12] gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) (#160648)

2026-10-25 06:43:46 -07:00

cookies.py

[3.12] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) (#146025)

2026-08-04 11:16:44 +02:00

server.py

[3.12] gh-119452: Fix a potential virtual memory allocation denial of service in http.server (GH-142216) (#142297)

2025-12-15 15:11:38 +01:00