This vulnerability arises because the initial fix for CVE-2026-0672, which aimed to reject control characters in http.cookies.Morsel, did not cover all code paths. The methods Morsel.update(), the |= operator, and unpickling were not patched, allowing control characters to bypass input validation. Furthermore, BaseCookie.js_output() lacked the output validation protections present in BaseCookie.output(), potentially enabling control characters to be processed improperly. This incomplete patching leads to residual risks in cookie handling within CPython.

The vulnerability allows control characters to bypass input validation in cookie handling components of CPython, which may lead to unexpected behavior or security issues related to improper cookie processing. The CVSS 4.0 score is 6.0 (medium severity), indicating a moderate impact with network attack vector, low attack complexity, and partial privileges required. There are no known exploits in the wild at this time.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, users should be cautious when processing cookies with affected CPython versions and consider applying any vendor recommendations once published.