Miss Islington (bot)andGregory P. Smith 6229895213 [3.11] gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) (#160649) ...

gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301)

DefaultCookiePolicy only applied its domain checks to cookies with
version 0 or a positive version.

ANT-2026-TA36I7V7
(cherry picked from commit d59d96853b)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

2026-10-25 12:35:37 -07:00

..

__init__.py

gh-91996: Add an HTTPMethod StrEnum to http (GH-91997)

2022-05-05 15:39:02 -07:00

client.py

[3.11] gh-150743: Limit trailer lines and interim responses read by http.client (GH-150749) (#152528)

2026-06-28 22:50:25 +02:00

cookiejar.py

[3.11] gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) (#160649)

2026-10-25 12:35:37 -07:00

cookies.py

[3.11] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (GH-145600) (#146026)

2026-06-28 23:16:33 +01:00

server.py

[3.11] gh-119452: Fix a potential virtual memory allocation denial of service in http.server (GH-142216) (#142298)

2026-01-25 17:10:45 +00:00