The vulnerability exists in Microdot's Response.set_cookie() method, which fails to sanitize string arguments containing the CRLF sequence. An attacker can use this flaw to perform header injection, leading to HTTP response splitting and the ability to inject arbitrary cookie values into the response. The injected headers are not executed as code on the server side, but they can manipulate client‑side processing of the response and potentially facilitate session fixation or other side‑channel attacks.

Microdot, a minimal Python web framework by Miguel Grinberg, is affected in all releases older than 2.6.1. Users running any unsupported or legacy version prior to the 2.6.1 release are potentially vulnerable.

The CVSS score is 3.7, indicating a low severity level. Exploitation requires that the attacker first compromise the client—such as through an independent XSS vulnerability—so that the malicious payload is sent to the server and stored in a cookie. The attack impacts only the compromised client; other users of the same application remain unaffected. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The overall risk is considered minimal, but the vulnerability could enable subtle response manipulation if the client is already subverted.