CPython http.cookiejar can delete other domains' cookies
Python rates CVE-2026-124249 medium: an expired Set-Cookie can remove cookies that belong to other domains.
48
Vulnerability1 · 1 read
CVE-2026-124249
Cross-domain cookie deletion in CPython http.cookiejar
- CVSS 4.0
- 6.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CPython's http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie, using Domain and Path from the header without consulting the cookie policy. A server the client contacts can trigger this over the network with no authentication or user interaction, removing cookies for other domains from a shared jar such as urllib's HTTPCookieProcessor. The attacker gains deletion of those cookies. Users of a shared CookieJar are affected; affected builds are not listed.
What to do: Apply the CPython update for CVE-2026-124249 so the cookie policy is checked before an expired Set-Cookie can delete a stored cookie.
| Product | Affected |
|---|---|
| Python CPython | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.
- Weakness
- CWE-346
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X