This vulnerability in CPython involves incomplete input validation for control characters in the http.cookies.Morsel class. While the initial fix for CVE-2026-0672 addressed some input validation issues, Morsel.update(), the |= operator, and unpickling mechanisms remained vulnerable to control characters bypassing validation. Moreover, BaseCookie.js_output() did not implement the same output validation as BaseCookie.output(), potentially allowing malformed cookie data to be processed. The CVSS 4.0 score is 6.0, indicating a medium severity with network attack vector, low attack complexity, and partial privileges required.

The vulnerability allows control characters to bypass input validation in cookie handling within CPython. This could potentially lead to issues such as improper cookie processing or injection of unexpected control characters. However, there are no known exploits in the wild at this time. The impact is rated medium severity based on the CVSS score of 6.0.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. No official patch or fix links are provided in the current data. Users should monitor vendor advisories for updates and apply any forthcoming patches promptly.