The vulnerability in http.cookies.Morsel allows an attacker to insert arbitrary HTTP header lines by including control characters in cookie names, values, or parameters. This can lead to HTTP response splitting, header injection, or cross‑site scripting via crafted headers. The flaw stems from insufficient validation of cookie components, classified as CWE‑93.

Python Software Foundation CPython is affected. Any CPython installation that uses the unpatched http.cookies.Morsel implementation and where application code allows user‑controlled cookie values is vulnerable. The specific version range is not listed, but the commit history indicates the issue existed before the patch was applied.

The CVSS score of 6.0 indicates medium severity, while the EPSS of less than 1% suggests a low probability of exploitation at the moment. The vulnerability has not been listed in the CISA KEV catalog. An attacker would need to control cookie values, which is typically feasible via a web application that trusts client input. The mitigation already rejects control characters, meaning the risk can be reduced through upgrading or input filtering.