{"id":"CVE-2026-124249","kind":"vulnerability","aliases":["CVE-2026-124249"],"related":[],"title":"Python: cookiejar lets a server delete cookies of other domains","description":"http.cookiejar.CookieJar deleted a stored cookie when a response carried an\nalready expired Set-Cookie header for it, using the Domain and Path\nattributes from the header without consulting the cookie policy. A server\ncould therefore delete cookies belonging to other domains from a shared\ncookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix\nconsults the cookie policy before an expired cookie may delete an existing\none, as required by RFC 6265 section 5.3.","summary":"Python's http.cookiejar deletes a stored cookie when a response sends an already expired Set-Cookie header, trusting the header's Domain and Path without checking the cookie policy. A malicious server can therefore remove cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-cookiejar","python","runtime","urllib"],"not_affected_if":["separate-cookie-jar-per-host","single-domain-client"],"how_to_check":"- Check the Python version with `python3 --version`; the sources do not list the exact affected ranges.\n- Look for code that shares one `http.cookiejar.CookieJar` across requests to different domains, for example through `urllib.request.HTTPCookieProcessor`.","fix":null,"status":"open","published_at":"2026-11-09T15:17:14+00:00","first_seen_at":"2026-11-09T15:27:06+00:00","triaged_at":"2026-11-09T15:28:06+00:00","updated_at":"2026-11-09T15:28:06+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T15:28:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Python: cookiejar lets a server delete cookies of other domains","impact":"low","summary":"Python's http.cookiejar deletes a stored cookie when a response sends an already expired Set-Cookie header, trusting the header's Domain and Path without checking the cookie policy. A malicious server can therefore remove cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["python","urllib","http-cookiejar"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"remote server deletes cookies of other domains in shared jar","analyst_note":"Find the affected and fixed Python versions from the Python security-announce post or the CPython changelog, and confirm the scope of the fix.","how_to_check":"- Check the Python version with `python3 --version`; the sources do not list the exact affected ranges.\n- Look for code that shares one `http.cookiejar.CookieJar` across requests to different domains, for example through `urllib.request.HTTPCookieProcessor`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-domain-client","separate-cookie-jar-per-host"],"who_is_affected":"Programs using Python's http.cookiejar, especially those that share one cookie jar across several domains through urllib's HTTPCookieProcessor. A single-domain client or one that uses a separate jar per host is less exposed. The sources do not give the affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000761,"input_tokens":4677,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124249':13A,16A '-2026':12A,15A '5.3':155C '6265':153C 'alreadi':35B,88C 'attribut':101C 'belong':60B,116C 'carri':86C 'check':49B 'consult':106C,136C 'cooki':7A,29B,39B,51B,59B,67B,82C,92C,108C,115C,123C,138C,143C 'cookiejar':2A,19B 'could':112C 'cve':11A,14A 'delet':6A,26B,79C,114C,145C 'domain':10A,45B,63B,98C,119C 'exist':147C 'expir':36B,89C,142C 'fix':135C 'header':40B,43B,93C,104C 'http':18B 'http-cookiejar':17B 'http.cookiejar':25B 'http.cookiejar.cookiejar':78C 'httpcookieprocessor':77B,133C 'jar':68B,124C 'let':3A 'malici':54B 'may':144C 'one':72B,128C,148C 'path':47B,100C 'polici':52B,109C,139C 'python':1A,20B,23B 'remov':58B 'requir':150C 'respons':32B,85C 'rfc':152C 'runtim':21B 'section':154C 'send':33B 'server':5A,55B,111C 'set':38B,91C 'set-cooki':37B,90C 'share':66B,122C 'store':28B,81C 'therefor':57B,113C 'trust':41B 'urllib':22B,75B,131C 'use':73B,96C,129C 'without':48B,105C","nicknames":[],"mitigations":[],"who_affected":"Programs using Python's http.cookiejar, especially those that share one cookie jar across several domains through urllib's HTTPCookieProcessor. A single-domain client or one that uses a separate jar per host is less exposed. The sources do not give the affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["httpcookiejar","medium","python","runtime","urllib"],"campaign_type":null,"search_a":"'-124249':13A,16A '-2026':12A,15A 'cooki':7A 'cookiejar':2A 'cve':11A,14A 'delet':6A 'domain':10A 'let':3A 'python':1A 'server':5A","search_b":"'alreadi':35B 'belong':60B 'check':49B 'cooki':29B,39B,51B,59B,67B 'cookiejar':19B 'delet':26B 'domain':45B,63B 'expir':36B 'header':40B,43B 'http':18B 'http-cookiejar':17B 'http.cookiejar':25B 'httpcookieprocessor':77B 'jar':68B 'malici':54B 'one':72B 'path':47B 'polici':52B 'python':20B,23B 'remov':58B 'respons':32B 'runtim':21B 'send':33B 'server':55B 'set':38B 'set-cooki':37B 'share':66B 'store':28B 'therefor':57B 'trust':41B 'urllib':22B,75B 'use':73B 'without':48B","search_c":"'5.3':155C '6265':153C 'alreadi':88C 'attribut':101C 'belong':116C 'carri':86C 'consult':106C,136C 'cooki':82C,92C,108C,115C,123C,138C,143C 'could':112C 'delet':79C,114C,145C 'domain':98C,119C 'exist':147C 'expir':89C,142C 'fix':135C 'header':93C,104C 'http.cookiejar.cookiejar':78C 'httpcookieprocessor':133C 'jar':124C 'may':144C 'one':128C,148C 'path':100C 'polici':109C,139C 'requir':150C 'respons':85C 'rfc':152C 'section':154C 'server':111C 'set':91C 'set-cooki':90C 'share':122C 'store':81C 'therefor':113C 'urllib':131C 'use':96C,129C 'without':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-07T19:58:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@python.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124249","severity":null,"published_at":"2026-11-09T15:17:14+00:00","modified_at":"2026-11-09T15:17:15+00:00","first_seen_at":"2026-11-09T15:27:06+00:00","fetched_at":"2026-11-09T15:27:06+00:00","note":null}],"documents":[{"id":107842,"url":"https://mail.python.org/archives/list/security-announce@python.org/message/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/","title":"Python security-announce: [Security-announce][CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie","kind":"advisory","source":"advisory","publisher":null,"text":"[Security-announce][CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie\n\nThere is a MEDIUM severity vulnerability affecting CPython. http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-124249 * https://github.com/python/cpython/pull/161570","published_at":"2026-11-07T19:58:34+00:00","relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}