CVE-2024-7592highCWE-400

CVE-2024-7592: fallo de gravedad alta en Python Software Foundation CPython

Quadratic complexity parsing cookies with backslashes

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear CPython+ Monitorear pypy3

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 2.3%
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
Python Software Foundation · CPython
CVEs relacionadas — Python Software Foundation CPython

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-6232HIGHRegular-expression DoS when parsing TarFile headersEPSS 2.2%CVE-2024-12254HIGHUnbounded memory buffering in SelectorSocketTransport.writelines()EPSS 1.9%CVE-2025-13836MEDIUMExcessive read buffering DoS in http.clientEPSS 1.7%CVE-2025-0938MEDIUMURL parser allowed square brackets in domain namesEPSS 1.6%CVE-2025-4138HIGHBypassing extraction filter to create symlinks to arbitrary targets outside extraction directoryEPSS 1.5%CVE-2025-4517CRITICALArbitrary writes via tarfile realpath overflowEPSS 1.5%