Miss Islington (bot) 62ceb396fc

[3.14] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) (#146023) ...

gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600)

Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`.
(cherry picked from commit 57e88c1cf95e1481b94ae57abe1010469d47a6b4)

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Victor Stinner <victor.stinner@gmail.com>

2026-03-16 14:13:19 +00:00

..

__init__.py

gh-129408: http: Fix typo 'RFF' to RFC' in documentation (#129411)

2025-01-28 13:25:51 -05:00

client.py

[3.14] gh-119451: Fix a potential denial of service in http.client (GH-119454) (#142138)

2025-12-01 20:34:09 +02:00

cookiejar.py

gh-130631: Make join_header_words() more similar to the original Perl version (GH-130632)

2025-04-09 11:08:04 +03:00

cookies.py

[3.14] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) (#146023)

2026-03-16 14:13:19 +00:00

server.py

[3.14] gh-119452: Fix a potential virtual memory allocation denial of service in http.server (GH-142216)

2025-12-05 16:20:23 +02:00