CVE-2026-42874 Overview
CVE-2026-42874 is a header injection vulnerability in Microdot, a minimalistic Python web framework maintained by Miguel Grinberg. Versions prior to 2.6.1 ship a Response.set_cookie() method that does not sanitize its string arguments. The method fails to detect carriage return and line feed (\r\n) sequences embedded in cookie values, enabling HTTP response header injection [CWE-113]. Exploitation requires an attacker to first compromise the victim client, for example through a separate cross-site scripting (XSS) flaw, before submitting malicious data destined for a server-side cookie. The vulnerability is fixed in Microdot 2.6.1.
Critical Impact
An attacker who already controls a victim client can inject arbitrary HTTP response headers into cookies set on that client's behalf, but cannot pivot to other clients.
Affected Products
- Microdot Python web framework versions prior to 2.6.1
- Applications using Response.set_cookie() with attacker-influenced input
- Microdot deployments without upstream cookie value sanitization
Discovery Timeline
- 2026-05-11 - CVE-2026-42874 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-42874
Vulnerability Analysis
The flaw resides in Microdot's Response.set_cookie() method. The method accepts string parameters for the cookie name, value, and attributes, then concatenates them directly into the Set-Cookie response header. Microdot performs no validation against control characters before emitting the header on the wire.
When an attacker-supplied string containing \r\n reaches set_cookie(), the framework writes those bytes verbatim into the HTTP response. Downstream parsers interpret the CRLF sequence as a header boundary, allowing the attacker to terminate the current header and append arbitrary new ones. This is a classic HTTP response splitting primitive mapped to [CWE-113] (Improper Neutralization of CRLF Sequences in HTTP Headers).
The practical impact is constrained. Microdot deployments only call set_cookie() with values that the application itself trusts, so the attacker must first influence what the server stores. The advisory notes that prior client compromise, such as an XSS payload in the same origin, is required to deliver the malicious cookie content. Compromise stays scoped to the already-infiltrated client.
Root Cause
The root cause is missing input neutralization in the cookie serialization path. Response.set_cookie() treats its arguments as opaque strings and omits a check for \r, \n, or the combined \r\n sequence before composing the header line.
Attack Vector
The attack vector is network-based but requires high attack complexity and prior client-side compromise. An attacker first lands a payload on the victim client through an independent vulnerability. The payload submits a request containing a CRLF-laced value that the server then passes to Response.set_cookie(). The injected header reaches only the originally compromised client.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-7wc8-wvc4-m498 for the maintainer's technical description.
Detection Methods for CVE-2026-42874
Indicators of Compromise
- Set-Cookie response headers containing raw \r\n, %0d%0a, or other CRLF encodings in their values
- HTTP responses from Microdot applications containing unexpected additional headers immediately after a Set-Cookie line
- Inbound request parameters carrying CRLF byte sequences that subsequently flow into cookie storage
Detection Strategies
- Inspect application and reverse proxy logs for cookie values containing control characters or URL-encoded CRLF sequences
- Run a software composition analysis (SCA) scan to identify Microdot versions earlier than 2.6.1 across Python services
- Add a web application firewall (WAF) rule that blocks request bodies and parameters containing %0d%0a targeting endpoints known to write cookies
Monitoring Recommendations
- Forward Microdot access logs and upstream proxy logs to a centralized analytics platform and alert on malformed Set-Cookie headers
- Track dependency manifests in source control to flag pinned Microdot versions below 2.6.1
- Correlate XSS detections with subsequent anomalous cookie-setting requests from the same session
How to Mitigate CVE-2026-42874
Immediate Actions Required
- Upgrade Microdot to version 2.6.1 or later in all Python services that import the framework
- Audit application code for calls to Response.set_cookie() that pass user-controlled input without prior validation
- Remediate any in-scope client-side vulnerabilities, particularly XSS, since they are the prerequisite for exploiting this issue
Patch Information
The maintainer fixed the vulnerability in Microdot 2.6.1. The corrective change is recorded in commit 99b281b and documented in the Microdot CHANGES file. Pin the upgraded version in requirements.txt or the equivalent dependency manifest and rebuild deployment artifacts.
Workarounds
- Validate and strip \r and \n characters from any value before passing it to Response.set_cookie()
- Wrap set_cookie() calls in an application-level helper that rejects strings containing CRLF or non-printable bytes
- Deploy a WAF or reverse proxy rule that drops responses containing malformed Set-Cookie headers as a defense-in-depth control
# Configuration example
pip install --upgrade 'microdot>=2.6.1'
pip show microdot | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
