-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the _unquote function within the http.cookies module, which exhibited quadratic complexity when parsing cookie values containing backslashes. This was due to its iterative use of regular expression searches. The patches provided replace this inefficient loop with a more performant approach using re.sub and a helper function _unquote_replace. The SimpleCookie.load method is the public interface that consumes cookie strings and internally calls _unquote, making it the entry point for exploiting this vulnerability. The commit messages and the added test cases (specifically test_unquote_large) confirm that _unquote was the source of the performance issue and that load is how it's typically invoked.
A Semantic Attack on Google Gemini - Read the Latest Research