- CVE-2026-4224: Modules/pyexpat.c conv_content_model could overflow the C stack when an Expat parser with a registered ElementDeclHandler parsed a deeply nested DTD content model, causing a denial-of-service. Wrap conv_content_model with Py_EnterRecursiveCall so deep nesting raises RuntimeError instead of crashing. - CVE-2026-0672 + CVE-2026-3644: Lib/Cookie.py Morsel accepted control characters in reserved-attribute values, in key/value/coded_value via .set(), and via the inherited dict.update() / pickle restoration paths, allowing newline-based HTTP header injection via Set-Cookie. Add a _has_control_character helper and validate at Morsel.__setitem__, .setdefault, .set, an explicit .update, an explicit .__setstate__, plus re-validate the assembled output in Morsel.js_output and BaseCookie.output (defence-in-depth against direct attribute mutation). The py3 __ior__ hunk is not ported (py2 dict has no `|=` operator).