{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "3.16.0"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              }
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "22d79d9840a275ed6ed36cd590dc74edc61765fb"
            }
          ],
          "repo": "https://github.com/python/cpython",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "PSF",
    "cwe_ids": [
      "CWE-74"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16052.json"
  },
  "details": "The http.cookies.Morsel class allows separator semicolons in attribute\nvalues\nand includes them verbatim in all output formats. An attacker who can\ncontrol\nthese values could use this to relax the cookie's Domain or SameSite\nrestrictions.",
  "id": "CVE-2026-16052",
  "modified": "2026-11-13T02:30:46.702273750Z",
  "published": "2026-11-12T16:28:03.251Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16052.json"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/python/cpython"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/python/cpython/issues/161707"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/pull/161711"
    },
    {
      "type": "WEB",
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IZL4QUFV7PKGT2JYSU2DCBMLTWYJDGKZ/"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16052"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel"
}