MEDIUM 6.3 NVD
CVE-2026-124249
a.k.a. CPython
http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from
http.cookiejar.CookieJar deleted a stored cookie when a response carried an
already expired Set-Cookie header for it, using the Domain and Path
attributes from the header without consulting the cookie policy. A server
could therefore delete cookies belonging to other domains from a shared
cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix
consults the cookie policy before an expired cookie may delete an existing
one, as required by RFC 6265 section 5.3.
References
- https://github.com/python/cpython/commit/4e9d037f1cfc8e29efcb1f67bc668e06ff2b6643
- https://github.com/python/cpython/commit/8eb3d2c1c41ca7ce628554413981c1eb763a1494
- https://github.com/python/cpython/commit/ac1d49f4fbb33941475c5aa3cb663ab39d64cb73
- https://github.com/python/cpython/issues/161569
- https://github.com/python/cpython/pull/161570
- https://www.openwall.com/lists/oss-security/2026/11/09/24
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-11-09 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.