The vulnerability arises from an incomplete implementation of control‑character validation within Python’s http.cookies module. Specifically, the Morsel.update() method, the bitwise OR assignment operator (|=), and the unpickling process were not patched to reject control characters, allowing them to bypass the intended checks. Additionally, BaseCookie.js_output() omitted the output validation present in BaseCookie.output(), creating another avenue for malicious characters to be processed by the cookie handling logic. This flaw can enable an attacker to inject arbitrary cookie values or manipulate HTTP headers, potentially leading to header injection, cookie poisoning, or other injection‑related attacks.

The affected vendor is the Python Software Foundation, product CPython. Specific version information was not included in the CVE data, so affected releases cannot be listed precisely.

The CVSS score of 6 indicates a medium severity impact. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that broad, automated exploitation is not yet documented. The likely attack vector is remote, as crafted HTTP requests containing control characters can be sent to any Python application that uses the http.cookies module to parse incoming cookies. If the application parses user‑supplied cookies without prior validation, an attacker could potentially alter HTTP response headers or inject additional cookies, leading to information disclosure or session hijacking. The absence of detailed exploitation proofs limits the assessment, but the medium score reflects a non‑zero risk when the flaw is present in production code.