Description

brettcs

opened on Nov 9, 2026

Issue body actions

Bug report

@ikow reported that http.cookies.Morsel.OutputString() does not quote or escape semicolons in cookie attribute values for path, domain, samesite, and version. The _has_control_character() validator (added in the CVE-2026-0672 fix) only checks C0 control characters ([\x00-\x1F\x7F]) and does not reject semicolons (0x3B), which are the Set-Cookie attribute delimiter per RFC 6265.

When an application reflects untrusted input into these cookie attributes, an attacker can inject arbitrary Set-Cookie attributes such as Domain, SameSite, Secure, and HttpOnly. Given the combination of how Morsel outputs cookies and how they're parsed, this opens up two possible attacks: SameSite policy downgrade and parent Domain expansion.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-161707: Refuse ; in all cookie attributes except Comment #161711

Reacted by Qi Deng

Activity

1. brettcs

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Nov 9, 2026
2. brettcs commented on Nov 9, 2026

   

   brettcs

   on Nov 9, 2026

   ContributorAuthor

   More actions

   RFC 6265 4.1.1 defines the syntax for attributes this way ("av" stands for "attribute value"):

   cookie-av         = expires-av / max-age-av / domain-av /
                       path-av / secure-av / httponly-av /
                       extension-av
   expires-av        = "Expires=" sane-cookie-date
   sane-cookie-date  = <rfc1123-date, defined in [RFC2616], Section 3.3.1>
   max-age-av        = "Max-Age=" non-zero-digit *DIGIT
                         ; In practice, both expires-av and max-age-av
                         ; are limited to dates representable by the
                         ; user agent.
   non-zero-digit    = %x31-39
                         ; digits 1 through 9
   domain-av         = "Domain=" domain-value
   domain-value      = <subdomain>
                         ; defined in [RFC1034], Section 3.5, as
                         ; enhanced by [RFC1123], Section 2.1
   path-av           = "Path=" path-value
   path-value        = <any CHAR except CTLs or ";">
   secure-av         = "Secure"
   httponly-av       = "HttpOnly"
   extension-av      = <any CHAR except CTLs or ";">
   

   I think there are two key takeaways from this. First, each attribute has its own expected value format. They don't expect to handle arbitrary strings and therefore the RFC defines no general quoting mechanism for them: it's not needed. Second, none of them allows ; in the value. That's most obvious in path-value and extension-value but if you walk through the rest of the definitions none of them allow ; in the end.

   Because of that, I believe the appropriate fix is for Morsel to refuse to accept any attribute values with ; in them, same way it does with control characters now, except in the Comment attribute. When Comment quoting was added, quoting all values was suggested, and Berker Peksag pointed out that this leads to odd outcomes like quoting all Path values (because they contain /) and it's doubtful that other cookie-handling software is expecting that. For more history see also #63869 and #77716. In general the idea of quoting all values stems from RFC 2109, which does allow this in its grammar, but has since been obseleted by RFC 6265.

   More generally, because all of these definitions are so tight, it would be a nice improvement if Morsel required all set attribute values to conform to their expected grammars. That would be the best defense against surprising inconsistencies between what Morsel users set and how the receiving party interprets them. But that's a bigger backwards compatibility change and not required to prevent the attacks described in the original report.

   Reacted by Senthil Kumaran
3. brettcs

   added a commit that references this issue on Nov 9, 2026

   pythongh-161707: Refuse `;` in all cookie attributes except Comment

   95a73b6
4. NekoAsakura

   added

   type-securityA security issueA security issue

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   and removed

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Nov 10, 2026
5. brettcs

   added 5 commits that reference this issue on Nov 10, 2026

   pythongh-161707: Fix reference in NEWS entry

   ab8bcb8

   pythongh-161707: Return the lowercase key from validation

   610dafc

   pythongh-161707: Refine doc markup

   84264de

   pythongh-161707: Explain that comment is an exception because it's es…

   981a55f

   pythongh-161707: Correct blurb markup

   a7ffa89

Issue actions