CVE-2024-7592
Quadratic complexity parsing cookies with backslashes
- State
- Published
- Severity
- 7.5 High
- Published
- Aug 19, 2024
- Updated
- Nov 3, 2025
- Reserved
- Aug 7, 2024
Description
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module.
When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
CPythonPython Software Foundation |
|
References
- https://github.com/python/cpython/pull/123075patch
- https://github.com/python/cpython/issues/123067issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/vendor-advisory
- https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621patch
- https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1patch
- https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06patch
- https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9apatch
- https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7fpatch
- https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774patch
- https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5efpatch
- https://security.netapp.com/advisory/ntap-20241018-0006/
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.