Medium4.8Red Hat & Ubuntu Linux

Header injection in http.cookies.Morsel in Python

CVE-2026-0672 Published Jan 20, 2026

CVE-2026-0672

Affected products & platforms

Red Hat & Ubuntu LinuxUnclassified

Summary

Header injection in http.cookies.Morsel in Python. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-93. Affected package(s): python3.12, rhui5/rhua-rhel9:1779798222, rhui5/installer-rhel9:1779798165. Resolved in Red Hat advisory RHSA-2026:19064 — update the affected packages (`sudo dnf update`).

Affected versions

python3.12-0:3.12.13-2.el9_8
python3.12-0:3.12.13-2.el10_2
python3.12-0:3.12.13-2.el8_10
rhui5/rhua-rhel9:1779798222
rhui5/installer-rhel9:1779798165

Official advisory · high-confidence parse· fetched 1 day ago·verify at source

Fixed versions

RHSA-2026:19064

Official advisory · high-confidence parse· fetched 1 day ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Update the affected package(s) to the fixed version shipped in RHSA-2026:19064 (`sudo dnf update` / `yum update`).

Official advisory · high-confidence parse· fetched 1 day ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.