CVE-2026-124249 · Runtime
NO FIX YET
Python's http.cookiejar deletes a stored cookie when a response sends an already expired Set-Cookie header, trusting the header's Domain and Path without checking the cookie policy. A malicious server can therefore remove cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor.
first public Nov 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Programs using Python's http.cookiejar, especially those that share one cookie jar across several domains through urllib's HTTPCookieProcessor. A single-domain client or one that uses a separate jar per host is less exposed. The sources do not give the affected version ranges.
Not affected if separate-cookie-jar-per-host, single-domain-client
Who cares http-cookiejar, python, urllib
python3 --version; the sources do not list the exact affected ranges.http.cookiejar.CookieJar across requests to different domains, for example through urllib.request.HTTPCookieProcessor.Unknown from the sources.
http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.