Read the docs
TI-2024-07037 Aliases CVE-2024-7592GHSA-7pwv-g7hj-39pr

Quadratic complexity parsing cookies with backslashes

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02303 83rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial CPython (Python Software Foundation): 3.8.20, 3.9.20, 3.10.15 +3Red Hat: 3 advisoriesRed Hat: 3 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Python Software FoundationCPythonbefore 3.8.20; 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.15; 3.11.0 to before 3.11.10; 3.12.0 to before 3.12.6; 3.13.0a1 to before 3.13.0rc23.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.6, 3.13.0rc2Patch availableCNA
  • CPython VendorPython Software Foundation Affected before 3.8.20; 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.15; 3.11.0 to before 3.11.10; 3.12.0 to before 3.12.6; 3.13.0a1 to before 3.13.0rc2 Fixed in 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.6, 3.13.0rc2 Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*before 3.8.20; 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.15; 3.11.0 to before 3.11.10; 3.12.0 to before 3.12.6Vulnerablepython-pillow
cpe:2.3:a:python:python:3.13.0:alpha0:*:*:*:*:*:*3.13.0 alpha0Vulnerablepython-pillow
cpe:2.3:a:python:python:3.13.0:alpha1:*:*:*:*:*:*3.13.0 alpha1Vulnerablepython-pillow
cpe:2.3:a:python:python:3.13.0:alpha2:*:*:*:*:*:*3.13.0 alpha2Vulnerablepython-pillow
cpe:2.3:a:python:python:3.13.0:alpha3:*:*:*:*:*:*3.13.0 alpha3Vulnerablepython-pillow
cpe:2.3:a:python:python:3.13.0:alpha4:*:*:*:*:*:*3.13.0 alpha4Vulnerablepython-pillow
cpe:2.3:a:python:python:3.13.0:alpha5:*:*:*:*:*:*3.13.0 alpha5Vulnerablepython-pillow
cpe:2.3:a:python:python:3.13.0:alpha6:*:*:*:*:*:*3.13.0 alpha6Vulnerablepython-pillow
cpe:2.3:a:python:python:3.13.0:beta1:*:*:*:*:*:*3.13.0 beta1Vulnerablepython-pillow
cpe:2.3:a:python:python:3.13.0:beta2:*:*:*:*:*:*3.13.0 beta2Vulnerablepython-pillow
  • cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions before 3.8.20; 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.15; 3.11.0 to before 3.11.10; 3.12.0 to before 3.12.6 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.13.0:alpha0:*:*:*:*:*:* Versions 3.13.0 alpha0 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.13.0:alpha1:*:*:*:*:*:* Versions 3.13.0 alpha1 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.13.0:alpha2:*:*:*:*:*:* Versions 3.13.0 alpha2 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.13.0:alpha3:*:*:*:*:*:* Versions 3.13.0 alpha3 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.13.0:alpha4:*:*:*:*:*:* Versions 3.13.0 alpha4 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.13.0:alpha5:*:*:*:*:*:* Versions 3.13.0 alpha5 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.13.0:alpha6:*:*:*:*:*:* Versions 3.13.0 alpha6 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.13.0:beta1:*:*:*:*:*:* Versions 3.13.0 beta1 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.13.0:beta2:*:*:*:*:*:* Versions 3.13.0 beta2 Vulnerable ·python-pillow
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:python:python:3.13.0:beta3:*:*:*:*:*:*3.13.0 beta3Vulnerablepython-pillow
cpe:2.3:a:python:python:3.13.0:beta4:*:*:*:*:*:*3.13.0 beta4Vulnerablepython-pillow
cpe:2.3:a:python:python:3.13.0:rc1:*:*:*:*:*:*3.13.0 rc1Vulnerablepython-pillow
  • cpe:2.3:a:python:python:3.13.0:beta3:*:*:*:*:*:* Versions 3.13.0 beta3 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.13.0:beta4:*:*:*:*:*:* Versions 3.13.0 beta4 Vulnerable ·python-pillow
  • cpe:2.3:a:python:python:3.13.0:rc1:*:*:*:*:*:* Versions 3.13.0 rc1 Vulnerable ·python-pillow

Remediation

  • Fix · CNA CPython (Python Software Foundation) Fixed in 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.6, 3.13.0rc2

Red Hat 3 advisories

  • RHSA-2025:3634 Released 2025-04-07 · Red Hat rating Low
    python3.11 security update
    • Red Hat CodeReady Linux Builder (v. 9) python3.11-3.11.9-7.el9_5.3, python3.11-debug-3.11.9-7.el9_5.3, python3.11-idle-3.11.9-7.el9_5.3 +2
    • Red Hat Enterprise Linux AppStream (v. 9) python3.11-3.11.9-7.el9_5.3, python3.11-devel-3.11.9-7.el9_5.3, python3.11-libs-3.11.9-7.el9_5.3 +1
  • RHSA-2025:3631 Released 2025-04-07 · Red Hat rating Low
    python3.12 security update
    • Red Hat CodeReady Linux Builder (v. 9) python3.12-3.12.5-2.el9_5.3, python3.12-debug-3.12.5-2.el9_5.3, python3.12-idle-3.12.5-2.el9_5.3 +2
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-3.12.5-2.el9_5.3, python3.12-devel-3.12.5-2.el9_5.3, python3.12-libs-3.12.5-2.el9_5.3 +1
  • RHSA-2024:10983 Released 2024-12-12 · Red Hat rating Moderate
    python3.9:3.9.21 security update
    • Red Hat CodeReady Linux Builder (v. 9) python3-3.9.21-1.el9_5, python3-debug-3.9.21-1.el9_5, python3-idle-3.9.21-1.el9_5 +2
    • Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.21-1.el9_5, python3-devel-3.9.21-1.el9_5, python3-tkinter-3.9.21-1.el9_5
    • Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.21-1.el9_5, python3-libs-3.9.21-1.el9_5, python3.9-3.9.21-1.el9_5

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)AffectedNo fix yet: Fix deferred
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2024:10983, RHSA-2025:3631, RHSA-2025:3634
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:10983, RHSA-2025:3631, RHSA-2025:3634
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2024:10983

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7592
  2. 2026-10-03 Alias added: GHSA-7pwv-g7hj-39pr

References

Exploit 1

Patch 8

Advisory 2

  • TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
  • TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
  • TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
  • TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
  • TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
  • TI-2025-07587 ZIP64 End of Central Directory (EOCD) Locator record offset not checked CVSS 3.1MEDIUM 4.3
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences