CVE-2026-3644

ADVISORY - nist

Summary

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

EPSS Score⁠: 0.00113 (0.300)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-116⁠

Improper Encoding or Escaping of Output

CWE-20⁠

Improper Input Validation

ADVISORY - redhat

CWE-791⁠

Incomplete Filtering of Special Elements

Impacted images

Advisories

Docker

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

CVE-2026-3644

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

NIST

CREATED

21 days ago

UPDATED

20 days ago

ADVISORY IDCVE-2026-3644⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-116⁠CWE-20⁠

CVSS SCORE

6medium

Debian

CREATED

20 days ago

UPDATED

9 days ago

ADVISORY IDCVE-2026-3644⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Ubuntu

CREATED

20 days ago

UPDATED

19 days ago

ADVISORY IDCVE-2026-3644⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Amazon

CREATED

7 days ago

UPDATED

7 days ago

ADVISORY IDALAS2-2026-3217⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Amazon

CREATED

7 days ago

UPDATED

7 days ago

ADVISORY IDALAS2-2026-3218⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Bitnami

CREATED

19 days ago

UPDATED

19 days ago

ADVISORY ID

BIT-libpython-2026-3644

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

6medium

Bitnami

CREATED

19 days ago

UPDATED

19 days ago

ADVISORY ID

BIT-python-2026-3644

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

6medium

Bitnami

CREATED

19 days ago

UPDATED

19 days ago

ADVISORY ID

BIT-python-min-2026-3644

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

6medium

Red Hat

CREATED

21 days ago

UPDATED

20 days ago

ADVISORY IDCVE-2026-3644⁠

EXPLOITABILITY SCORE

2.8

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-791⁠

CVSS SCORE

5.4medium

Chainguard

CREATED

2 days ago

UPDATED

2 days ago

ADVISORY ID

CGA-x3jx-7xjp-vpm8

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

12 hours ago

UPDATED

12 hours ago

ADVISORY ID

MINI-f36w-g3gx-qm83

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

12 hours ago

UPDATED

12 hours ago

ADVISORY ID

MINI-g56q-jvcw-gqw6

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

12 hours ago

UPDATED

12 hours ago

ADVISORY ID

MINI-v4jw-865m-9wr6

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

12 hours ago

UPDATED

12 hours ago

ADVISORY ID

MINI-x38x-p8r4-rhf5

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

12 hours ago

UPDATED

12 hours ago

ADVISORY ID

MINI-xwh9-pj6q-58x2

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY