VDB
ALPINE-CVE-2024-7592
ALPINE-CVE-2024-7592
PUBLISHED
CVSS 7.5 HIGH
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.22 | python3 | 0, 3.11.4-r2, 3.11.4-r4 |
| Alpine:v3.21 | python3 | 3.5.2-r1, 3.10.1-r0, 3.10.2-r0 |
| Alpine:v3.20 | python3 | 3.8.2-r2, 3.6.2-r2, 3.6.2-r3 |
| Alpine:v3.19 | python3 | 3.6.2-r2, 3.6.2-r1, 3.6.2-r0 |
| Alpine:v3.18 | python3 | 3.9.7-r3, 0, 3.1.3-r0 |
| Alpine:v3.17 | python3 | 3.5.0-r0, 3.4.3-r2, 3.4.3-r1 |
| Alpine:v3.24 | python3 | 0 |
| Alpine:v3.23 | python3 | 3.8.1-r1, 3.11.4-r2, 3.11.1-r0 |
Timeline
- Aug 19, 2024 CVE Published
- Apr 30, 2026 Distribution Patch
- Jun 15, 2026 CVE Updated