CVE-2026-42874

Description

Microdot has HTTP response splitting in Response.set_cookie()

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• https://github.com/miguelgrinberg/microdot/blob/main/CHANGES.md
• https://github.com/miguelgrinberg/microdot/commit/99b281b45faef8472410f2d56bfef496dfbd95d5
• https://github.com/miguelgrinberg/microdot/security/advisories/GHSA-7wc8-wvc4-m498
• https://nvd.nist.gov/vuln/detail/CVE-2026-42874
• https://github.com/miguelgrinberg/microdot
• https://github.com/advisories/GHSA-7wc8-wvc4-m498

CWEs

CWE-113