This vulnerability arises from an incomplete fix for CVE-2026-0672 in CPython's http.cookies.Morsel class. While the original fix rejected control characters, the Morsel.update() method, the |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, the BaseCookie.js_output() method lacked the output validation applied to BaseCookie.output(), further contributing to the issue. These flaws could allow malicious input to circumvent intended restrictions on control characters in cookie handling.

The vulnerability allows control characters to bypass input validation in cookie handling within CPython. This could lead to unexpected behavior or security issues related to cookie processing, such as injection or manipulation of cookie data. The CVSS score of 6 indicates a medium severity impact with network attack vector, low complexity, and partial impact on confidentiality and high impact on integrity.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, users should be cautious when processing untrusted cookie data and consider applying additional input validation or sandboxing measures as a temporary mitigation.