CVE-2026-16052
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 12, 2026
Vendor
unknown
Description
The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.