Microdot versions before 2.6.1 have an improper neutralization of CRLF sequences in HTTP headers due to the Response.set_cookie() method not sanitizing input strings. This allows an attacker who has already infiltrated a client to perform HTTP header injection by injecting CRLF sequences into cookie values. Exploitation requires prior client compromise, limiting the scope of impact to that client only. The vulnerability is classified under CWE-113 and has a CVSS 3.1 base score of 3.7 (low severity). The issue is resolved in microdot 2.6.1.

The vulnerability allows HTTP header injection via unsanitized cookie values, which can lead to HTTP response splitting attacks. However, exploitation requires prior compromise of the client to inject malicious data, restricting the attacker's ability to affect only the infiltrated client. There is no impact on confidentiality or availability, and the integrity impact is low. No known exploits are reported in the wild.

Upgrade microdot to version 2.6.1 or later, where the Response.set_cookie() method properly sanitizes input to prevent CRLF injection. Since this is an official fix, applying the update fully mitigates the vulnerability. Patch status is not explicitly stated in the advisory, but the fix is confirmed in version 2.6.1.