AZL-113810

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113810.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-113810

Upstream

CVE-2026-16052

Published

2026-11-12T17:17:44Z

Modified

2026-11-13T14:15:11Z

Summary

CVE-2026-16052 affecting package python3 3.12.16-2

Details

The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-16052

Affected packages

Azure Linux:3 / python3

Package

Name: python3
Purl: pkg:rpm/azure-linux/python3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.12.16-2

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113810.json"