USN-8744-1: Python vulnerabilities
Ubuntu issued USN-8744-1 fixing CVE-2026-3644, a Python http.cookies content-injection flaw, plus a pyexpat recursion DoS across six Ubuntu LTS releases.
Ubuntu published security notice USN-8744-1 addressing two Python vulnerabilities affecting Ubuntu 14.04 LTS through 24.04 LTS. CVE-2026-3644 concerns incorrect handling of control characters in the http.cookies module, which could allow an attacker to inject arbitrary content. The second issue involves unbounded recursion in the Expat XML parser reached via the pyexpat module, which could crash Python and cause a denial of service. Updated packages are available; no exploitation in the wild is reported.
- CVE-2026-3644: Python http.cookies mishandles control characters, allowing possible arbitrary content injection.
- Unbounded recursion in pyexpat/Expat XML parsing can crash Python, causing denial of service.
- Affects Ubuntu 14.04, 16.04, 18.04, 20.04, 22.04 and 24.04 LTS.
- Patched Python packages released via Ubuntu security notice USN-8744-1.
- CVEs
- CVE-2026-3644
- Products
- PythonUbuntu 24.04 LTS
- Organizations
- Canonical
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-3644 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete | 6.0 | <1% |
From the original article
It was discovered that Python's http. cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.