https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-14T21:20:24.912246+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-16052 fkie_cve-2026-16052 2026-11-14T21:20:24.914221+00:00

The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.

 https://db.gcve.eu/vuln/ghsa-x8gr-g883-r98g GHSA-x8gr-g883-r98g 2026-11-14T21:20:24.914294+00:00

The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.

 https://db.gcve.eu/vuln/msrc_cve-2026-16052 msrc_CVE-2026-16052 — Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel 2026-11-14T21:20:24.914314+00:00 msrc_CVE-2026-16052 https://db.gcve.eu/vuln/ubuntu-cve-2026-16052 UBUNTU-CVE-2026-16052 2026-11-14T21:20:24.914334+00:00

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 8 more

The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.