Python: Quadratic complexity parsing cookies with backslashes (CVE-2024-7592)
CVE-2024-7592 is a vulnerability in the Python standard library module http.cookies that causes quadratic complexity when parsing cookies containing backslashes in quoted characters. This results in excessive CPU resource consumption during parsing. The issue affects multiple Python versions prior to specific fixed releases. Red Hat has issued security advisories rating the impact as low and providing updates for affected Python packages. No known exploits are reported in the wild. A patch is available to address the vulnerability.
AI Analysis
Technical Summary
This vulnerability (CVE-2024-7592) affects the CPython http.cookies module where parsing cookies with backslashes for quoted characters uses an algorithm with quadratic complexity. This inefficiency leads to uncontrolled CPU resource consumption. The vulnerability affects various Python versions including older 2.x and 3.x releases up to but excluding fixed versions such as 3.8.20, 3.9.20, 3.10.15, 3.11.10, and 3.12.6. Red Hat advisories confirm the issue and provide patched package updates for Red Hat Enterprise Linux 9 variants. The severity is rated low by Red Hat, despite the initial high severity label, and no active exploitation is known.
Potential Impact
The vulnerability causes excessive CPU usage when parsing specially crafted cookies containing backslashes, potentially leading to denial of service conditions due to resource exhaustion. However, Red Hat rates the security impact as low, indicating limited practical impact or exploitability. There are no known exploits in the wild.
Mitigation Recommendations
A patch is available and should be applied to affected Python versions. Red Hat has released updated python3.11 and python3.12 packages for Red Hat Enterprise Linux 9 and related variants. Users should follow vendor guidance to update to these fixed versions. Since the vendor advisory rates the impact as low and provides fixes, applying the official updates is the recommended mitigation.
Python: Quadratic complexity parsing cookies with backslashes (CVE-2024-7592)
Description
CVE-2024-7592 is a vulnerability in the Python standard library module http.cookies that causes quadratic complexity when parsing cookies containing backslashes in quoted characters. This results in excessive CPU resource consumption during parsing. The issue affects multiple Python versions prior to specific fixed releases. Red Hat has issued security advisories rating the impact as low and providing updates for affected Python packages. No known exploits are reported in the wild. A patch is available to address the vulnerability.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2024-7592) affects the CPython http.cookies module where parsing cookies with backslashes for quoted characters uses an algorithm with quadratic complexity. This inefficiency leads to uncontrolled CPU resource consumption. The vulnerability affects various Python versions including older 2.x and 3.x releases up to but excluding fixed versions such as 3.8.20, 3.9.20, 3.10.15, 3.11.10, and 3.12.6. Red Hat advisories confirm the issue and provide patched package updates for Red Hat Enterprise Linux 9 variants. The severity is rated low by Red Hat, despite the initial high severity label, and no active exploitation is known.
Potential Impact
The vulnerability causes excessive CPU usage when parsing specially crafted cookies containing backslashes, potentially leading to denial of service conditions due to resource exhaustion. However, Red Hat rates the security impact as low, indicating limited practical impact or exploitability. There are no known exploits in the wild.
Mitigation Recommendations
A patch is available and should be applied to affected Python versions. Red Hat has released updated python3.11 and python3.12 packages for Red Hat Enterprise Linux 9 and related variants. Users should follow vendor guidance to update to these fixed versions. Since the vendor advisory rates the impact as low and provides fixes, applying the official updates is the recommended mitigation.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:3634
- Cve Count
- 1
Threat ID: 6a3da1d54853345fc1826ea2
Added to database: 06/25/2026, 21:47:01 UTC
Last enriched: 09/08/2026, 15:12:26 UTC
Last updated: 09/10/2026, 19:24:54 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.