- CVE-2026-0672: reject control characters in the Cookie module - add the _has_control_character() helper and validate in Morsel.__setitem__, Morsel.setdefault(), Morsel.set() and BaseCookie.output(). Applied as the prerequisite for CVE-2026-3644; Python 2.7.5 shipped neither fix. - CVE-2026-3644: reject control characters in Morsel.update(), the unpickling path (Morsel.__setstate__) and Morsel.js_output(). - CVE-2026-4224: guard conv_content_model() in pyexpat with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() to avoid a C stack overflow when parsing a deeply nested content model in an inline DTD with a registered ElementDeclHandler. - CVE-2025-13462: skip the old-v7 AREGTYPE -> DIRTYPE normalization in tarfile when reading a follow-up header (GNU long name/link or PAX extended header), so crafted multi-block members are no longer misinterpreted.