---
id: "CVE-2026-124249"
page: "https://infrastack.ai/live/CVE-2026-124249"
kind: "vulnerability"
aliases: ["CVE-2026-124249"]
title: "Python: cookiejar lets a server delete cookies of other domains"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["http-cookiejar", "python", "runtime", "urllib"]
not_affected_if: ["separate-cookie-jar-per-host", "single-domain-client"]
published_at: "2026-11-09T15:17:14+00:00"
first_seen_at: "2026-11-09T15:27:06+00:00"
updated_at: "2026-11-09T15:28:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124249", "first_seen_at": "2026-11-09T15:27:06+00:00"}]
exploit_sources: []
---

# Python: cookiejar lets a server delete cookies of other domains

Link for people: https://infrastack.ai/live/CVE-2026-124249 (this .md is for agents)

Python's http.cookiejar deletes a stored cookie when a response sends an already expired Set-Cookie header, trusting the header's Domain and Path without checking the cookie policy. A malicious server can therefore remove cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Python version with `python3 --version`; the sources do not list the exact affected ranges.
- Look for code that shares one `http.cookiejar.CookieJar` across requests to different domains, for example through `urllib.request.HTTPCookieProcessor`.

## Timeline

- 2026-11-09T15:27:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124249

## Documents

- [advisory] Python security-announce: [Security-announce][CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie https://mail.python.org/archives/list/security-announce@python.org/message/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/

## From the sources

http.cookiejar.CookieJar deleted a stored cookie when a response carried an
already expired Set-Cookie header for it, using the Domain and Path
attributes from the header without consulting the cookie policy. A server
could therefore delete cookies belonging to other domains from a shared
cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix
consults the cookie policy before an expired cookie may delete an existing
one, as required by RFC 6265 section 5.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_