7.5

CVE-2024-7592: Quadratic complexity parsing cookies with backslashes

Modified
AliasesALPINE-CVE-2024-7592SUSE-SU-2026:0774-1SUSE-SU-2026:0802-1
Published 19-08-2024Last modified 03-11-2025

Vulnerability summary

CVE-2024-7592 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in python software foundation cpython. EPSS estimates a 2.30% chance of exploitation in the next 30 days, higher than 83.3% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
2.30%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 28 · Related 30
DLA-3980-1DLA-4354-1MGASA-2024-0317OPENSUSE-SU-2024:14326-1OPENSUSE-SU-2024:14345-1OPENSUSE-SU-2024:14346-1

Timeline

  1. 19-08-2024
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

2.30%

Chance of exploitation in the next 30 days

Percentile

83%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.30% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Cpython

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat18 products
  • python3.11< 0:3.11.9-7.el9_5.3
  • python3.11-debug< 0:3.11.9-7.el9_5.3
  • python3.11-debuginfo< 0:3.11.9-7.el9_5.3
  • python3.11-debugsource< 0:3.11.9-7.el9_5.3
  • python3.11-devel< 0:3.11.9-7.el9_5.3
Ubuntu10 products
  • python2.7< 2.7.6-8ubuntu0.6+esm20 | < 2.7.12-1ubuntu0~16.04.18+esm10 | < 2.7.17-1~18.04ubuntu1.13+esm5 | < 2.7.18-1~20.04.4+esm2 | < 2.7.18-13ubuntu1.2+esm2
  • python3.10< 3.10.12-1~22.04.6
  • python3.11All versions (No fix recorded)
  • python3.12< 3.12.3-1ubuntu0.2
  • python3.4All versions (No fix recorded)
Chainguard7 products
  • nodejs-18< 18.20.8-r4
  • nodejs-20< 20.19.5-r0
  • nodejs-22< 22.21.1-r0 | < 22.21.1-r1
  • python-3.10< 3.10.15-r0
  • python-3.11< 3.11.9-r9
Wolfi6 products
  • nodejs-18< 18.20.8-r4
  • nodejs-20< 20.19.5-r0
  • nodejs-22< 22.21.1-r0 | < 22.21.1-r1
  • python-3.10< 3.10.15-r0
  • python-3.11< 3.11.9-r9
Suse5 products
  • python-base&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 2.7.18-150000.105.1
  • python-base&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 2.7.18-33.66.1
  • python-doc&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 2.7.18-33.66.1
  • python&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 2.7.18-150000.105.1
  • python&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 2.7.18-33.66.1
Opensuse4 products
  • python-base&distro=openSUSE Leap 15.6< 2.7.18-150000.105.1
  • python-doc&distro=openSUSE Leap 15.6< 2.7.18-150000.105.1
  • python39&distro=openSUSE Tumbleweed< 3.9.20-2.1
  • python&distro=openSUSE Leap 15.6< 2.7.18-150000.105.1
Debian3 products
  • pypy3All versions (No fix recorded) | < 7.3.18+dfsg-1
  • python3.11< 3.11.2-6+deb12u5
  • python3.13< 3.13.0~rc2-1
Alpine2 products
  • py3-tornado< 6.4.2-r0
  • python3< 3.10.15-r0 | < 3.11.10-r0 | < 3.12.6-r0
Python1 product
  • python< 3.8.20 | ≥ 3.9.0, < 3.9.20 | ≥ 3.10.0, < 3.10.15 | ≥ 3.11.0, < 3.11.10 | ≥ 3.12.0, < 3.12.6 | 3.13.0:alpha0 | 3.13.0:alpha1 | 3.13.0:alpha2 | 3.13.0:alpha3 | 3.13.0:alpha4 | 3.13.0:alpha5 | 3.13.0:alpha6 | 3.13.0:beta1 | 3.13.0:beta2 | 3.13.0:beta3 | 3.13.0:beta4 | 3.13.0:rc1
Python software foundation1 product
  • cpython< 3.8.20 | ≥ 3.9.0, < 3.9.20 | ≥ 3.10.0, < 3.10.15 | ≥ 3.11.0, < 3.11.10 | ≥ 3.12.0, < 3.12.6 | ≥ 3.13.0a1, < 3.13.0rc2

10 vendors · 57 products

References

33 links
Show all 33 references