CVE-2026-124249
`http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.
| CWE | CWE-346 |
| Vendor | python software foundation |
| Product | cpython |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for python software foundation cpython
Be the first to know when new unknown vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Python Software Foundation / CPython
0 < 3.16.0
References
github.com: https://github.com/python/cpython/pull/161570 github.com: https://github.com/python/cpython/issues/161569 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/ openwall.com: http://www.openwall.com/lists/oss-security/2026/11/09/24
Credits
🔍 Grant Abejar (https://github.com/vinzabe) Kirill Podoprigora (https://github.com/Eclips4) Victor Stinner (https://github.com/vstinner)