VDB
ALPINE-CVE-2024-7592
ALPINE-CVE-2024-7592
PUBLISHED
CVSS 7.5 HIGH
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.
Risk Scores
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.22 | python3 | 3.11.4-r4, 3.11.5-r0, 3.11.6-r0 |
| Alpine:v3.21 | python3 | 3.5.2-r10, 3.10.1-r0, 3.10.2-r0 |
| Alpine:v3.20 | python3 | 3.8.2-r2, 3.6.2-r2, 3.6.2-r3 |
| Alpine:v3.19 | python3 | 3.6.2-r1, 3.6.2-r0, 3.6.1-r4 |
| Alpine:v3.18 | python3 | 3.9.7-r3, 0, 3.1.3-r0 |
| Alpine:v3.17 | python3 | 3.9.7-r4, 3.9.7-r3, 3.9.7-r2 |
| Alpine:v3.23 | python3 | 3.1.3-r0, 3.10.0-r1, 3.10.6-r0 |
Timeline
- Aug 19, 2024 CVE Published
- Dec 3, 2025 CVE Updated
- Apr 30, 2026 Distribution Patch