ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

Ubuntu 24.04 LTS

1 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

USN-8744-1: Python vulnerabilities

Ubuntu issued USN-8744-1 fixing CVE-2026-3644, a Python http.cookies content-injection flaw, plus a pyexpat recursion DoS across six Ubuntu LTS releases.

Ubuntu published security notice USN-8744-1 addressing two Python vulnerabilities affecting Ubuntu 14.04 LTS through 24.04 LTS. CVE-2026-3644 concerns incorrect handling of control characters in the http.cookies module, which could allow an attacker to inject arbitrary content. The second issue involves unbounded recursion in the Expat XML parser reached via the pyexpat module, which could crash Python and cause a denial of service. Updated packages are available; no exploitation in the wild is reported.

Ubuntu Security Noticesupdated · 4d agofirst · 5d agoAdvisory 13 sourcesCVE-2026-36441

Related CVEs

  • CVE-2026-36446.0<1%
    The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete.
    The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
    · python python—

Appears with

organization Canonical 1product Python 1vendor Canonical 1vendor Ubuntu 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.