2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst

Reject control characters in :class:`http.cookies.Morsel` :meth:`~http.cookies.Morsel.update` and :meth:`~http.cookies.BaseCookie.js_output`. This addresses :cve:`2026-3644`.