CPython http.cookiejar can delete other domains' cookies
Original title: CPython: [CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie
Python rates CVE-2026-124249 medium: an expired Set-Cookie can remove cookies that belong to other domains.
Kirill Podoprigora reported a medium-severity CPython issue, CVE-2026-124249, which Alan Coopersmith forwarded to oss-security on November 9. The title says http.cookiejar deletes cookies of other domains when it processes an expired Set-Cookie. The forwarded message is cut off after the severity statement, with no versions, patch, or exploitation details.
Unconfirmed: The notice is truncated, so affected versions, the fix, and whether it is exploited are not stated.
- The original notice is dated November 7, 2026.
- It was sent through Python's security-announce list.
- The public text stops before describing scope or a fix.
Impact: Cookies belonging to other domains can be deleted
| Product | Affected |
|---|---|
| CPython | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124249 | Cross-domain cookie deletion in CPython http.cookiejar | 6.3 | — |
From the original article
Posted by Alan Coopersmith on Nov 09 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-124249] http. cookiejar deletes cookies of other domains via expired Set-Cookie Date: Sat, 7 Nov 2026 21:58:22 +0200 From: Kirill Podoprigora via Security-announce Reply-To: security-sig () python org To: security-announce () python org CC: Kirill Podoprigora There is a MEDIUM...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.