Vulnerability · medium · CVSS 6.3
CPython: [CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Python code using http.cookiejar with multiple cookie domains
Tier B because: Core infrastructure or popular tool AND remote, no login
Reach
Attack
Damage
Fix
Popular tool · Remote, no login
The Brief
- CVE-2026-124249 affects the http.cookiejar module in CPython.
- A crafted expired Set-Cookie header can cause http.cookiejar to delete cookies belonging to other domains.
Why it matters
Applications using http.cookiejar may lose cookies for other sites they rely on, which can break sessions or logins for code that handles multiple domains.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: CPython's standard library is used by developers and ops teams to build and run software. |
| No | Core infrastructure | Judgment: a single stdlib module in CPython is not core infrastructure like OpenSSH or glibc. |
| Yes | Popular tool | Judgment: Python is a mainstream developer platform and this flaw is in its standard library. |
| No | Exploited in the wild | Open Source Security advisory describes the flaw only; no source reports observed attacks. |
| No | Public exploit | Open Source Security advisory gives no exploit code or proof-of-concept details. |
| Yes | Remote, no login | CVSSCVE-2026-124249: CVSS 6.3 – network, no privileges, no user interaction |
| No | Full takeover | CVSSCVSS: no CVE has both high confidentiality and integrity impact |
| No | Secrets exposed | Open Source Security advisory reports cookie deletion; no source reports data theft or exposure. |
| No | Supply chain | Open Source Security advisory describes a normal bug in legitimate code, not malicious shipped code. |
| No | No fix yet | Open Source Security advisory does not say whether a patched version exists, so this is not confirmed. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-124249 ↗CVSS 6.3 medium AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
`http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation
- Exploited
- Not in CISA’s exploited catalog
- Weakness
- CWE-346
Timeline
Vulnerability disclosed to the Security-announce list by Kirill Podoprigora
Advisory posted to the oss-sec mailing list by Alan Coopersmith
Open Source Security
CPython: [CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie
Source
CPython: [CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie ↗ Open Source Security · 3h ago
First seen · 1 source · Full story page · How tiers are decided