Skip to content

[3.10] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (#145600) #185852

[3.10] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (#145600)

[3.10] gh-145599, CVE 2026-3644: Reject control characters in http.cookies.Morsel.update() (#145600) #185852

Triggered via pull request March 16, 2026 13:47
Status Cancelled
Total duration 8m 45s
Artifacts

build.yml

on: pull_request
Check for source changes
11s
Check for source changes
Matrix: Ubuntu SSL tests with OpenSSL
Fit to window
Zoom out
Zoom in

Annotations

9 errors and 10 warnings
Windows (x86)
Canceling since a higher priority waiting request for Tests-cookies10 exists
Windows (x86)
The operation was canceled.
macOS
Canceling since a higher priority waiting request for Tests-cookies10 exists
macOS
The operation was canceled.
Ubuntu
Canceling since a higher priority waiting request for Tests-cookies10 exists
Ubuntu
The operation was canceled.
Windows (x64)
Canceling since a higher priority waiting request for Tests-cookies10 exists
Windows (x64)
The operation was canceled.
Tests
Canceling since a higher priority waiting request for Tests-cookies10 exists
Check if the ABI has changed
The `python-version` input is not set. The version of Python currently in `PATH` will be used.
Check if generated files are up to date
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: hendrikmuhs/ccache-action@v1. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Check if generated files are up to date
The `python-version` input is not set. The version of Python currently in `PATH` will be used.
macOS
tcl-tk@8 8.6.17 is already installed and up-to-date. To reinstall 8.6.17, run: brew reinstall tcl-tk@8
macOS
gdbm 1.26 is already installed and up-to-date. To reinstall 1.26, run: brew reinstall gdbm
macOS
xz 5.8.2 is already installed and up-to-date. To reinstall 5.8.2, run: brew reinstall xz
macOS
pkgconf 2.5.1 is already installed and up-to-date. To reinstall 2.5.1, run: brew reinstall pkgconf
Ubuntu
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: hendrikmuhs/ccache-action@v1. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Ubuntu: Objects/longobject.c#L1763
‘kind’ may be used uninitialized [-Wmaybe-uninitialized]
Ubuntu: Objects/longobject.c#L1940
‘kind’ may be used uninitialized [-Wmaybe-uninitialized]