CVE-2026-124249 | BDVDB-2026-402394 Detail
Python Software FoundationCPython
Description#
http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.
Impact#
Per CVSS v4.0: confidentiality impact none, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
References#
- https://github.com/python/cpython/pull/161570
- https://github.com/python/cpython/issues/161569
- https://mail.python.org/archives/list/security-announce@python.org/thread/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/
- https://github.com/python/cpython/commit/4e9d037f1cfc8e29efcb1f67bc668e06ff2b6643
- https://github.com/python/cpython/commit/8eb3d2c1c41ca7ce628554413981c1eb763a1494
- https://github.com/python/cpython/commit/ac1d49f4fbb33941475c5aa3cb663ab39d64cb73
- http://www.openwall.com/lists/oss-security/2026/11/09/24
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.