SecurityFan score 43 · Tier B
CPython: [CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie
The Brief
- CVE-2026-124249 affects the http.cookiejar module in CPython.
- A crafted expired Set-Cookie header can cause http.cookiejar to delete cookies belonging to other domains.
Why it matters
Applications using http.cookiejar may lose cookies for other sites they rely on, which can break sessions or logins for code that handles multiple domains.
Who’s affected
- Python developers using http.cookiejar
- Projects running CPython with affected versions
Posted by Alan Coopersmith on Nov 09 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie Date: Sat, 7 Nov 2026 21:58:22 +0200 From: Kirill Podoprigora via Security-announce…
Timeline
Vulnerability disclosed to the Security-announce list by Kirill Podoprigora
Advisory posted to the oss-sec mailing list by Alan Coopersmith
Open Source Security
CPython: [CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie