GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.14] gh-143919: Reject control characters in http cookies by miss-islington · Pull Request #144089 · python/cpython

Conversation

@miss-islington

@miss-islington miss-islington commented Jan 20, 2026 •
edited by github-actions Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

(cherry picked from commit 95746b3)

Co-authored-by: Seth Michael Larson [email protected]
Co-authored-by: Bartosz Sławecki [email protected]
Co-authored-by: sobolevn [email protected]

  • Issue: Reject control characters in http.cookies.Morsel #143919

📚 Documentation preview 📚: https://cpython-previews--144089.org.readthedocs.build/

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@sethmlarson @johnslavik
@sobolevn @miss-islington
pythongh-143919: Reject control characters in http cookies
2bb0ca8 
(cherry picked from commit 95746b3)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Bartosz Sławecki <[email protected]>
Co-authored-by: sobolevn <[email protected]>
@bedevere-app bedevere-app Bot mentioned this pull request Jan 20, 2026
Reject control characters in http.cookies.Morsel #143919
Closed
@bedevere-app bedevere-app Bot added the awaiting review label Jan 20, 2026
@sethmlarson sethmlarson added type-security A security issue release-blocker labels Jan 20, 2026
@github-project-automation github-project-automation Bot added this to Release and Deferred blockers 🚫 Jan 20, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫 Jan 20, 2026
@sethmlarson
sethmlarson requested a review from hugovk January 20, 2026 22:33
@hugovk
hugovk merged commit 712452e into python:3.14 Jan 23, 2026
54 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@github-project-automation github-project-automation Bot moved this from Todo to Done in Release and Deferred blockers 🚫 Jan 23, 2026
@bedevere-app bedevere-app Bot removed the awaiting review label Jan 23, 2026
@miss-islington
miss-islington deleted the backport-95746b3-3.14 branch January 23, 2026 11:44
ihvo pushed a commit to ihvo/azurelinux that referenced this pull request Apr 24, 2026
Ihar Voitka @claude
Drop all carried CVE patches from python3.14 — upstream in 3.14.4
10ed2bc 
Verified against python/cpython that every CVE patch on the 3.12 fork has a
3.14-branch backport PR that merged before 3.14.4's release on 2026-04-07:

  CVE-2026-0672 → PR python/cpython#144089 (merged 2026-01-23)
  CVE-2026-0865 → PRs python/cpython#143972 + #144761 (merged 2026-01-17 / 02-21)
  CVE-2026-1299 → PR python/cpython#144182 (merged 2026-01-25)
  CVE-2026-4519 → PRs python/cpython#146214 + #148042 (merged 2026-03-23 / 04-03)

The CVE-2025-* patches are even older and were already in 3.14.0 (GA 2025-10).
Carrying patches we don't need adds hunk-maintenance cost, rebase risk, and
auditor confusion with no upside.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
@ihvo ihvo mentioned this pull request Apr 24, 2026
Add python3.14 package (side-by-side with python3) microsoft/azurelinux#16856
Closed
9 of 11 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hugovk hugovk Awaiting requested review from hugovk

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@miss-islington @hugovk @sethmlarson
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.