# CPython: [CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/604) · 2026-11-09 · Security
Page: https://themorning.dev/story/cpython-cve-2026-124249-http-cookiejar-deletes-cookies-of-other-domains-via-expi-987811c0f5d6ba8d
Kind: security · Impact: medium

## In brief

- CVE-2026-124249 affects the http.cookiejar module in CPython.
- A crafted expired Set-Cookie header can cause http.cookiejar to delete cookies belonging to other domains.

## Why it matters

Applications using http.cookiejar may lose cookies for other sites they rely on, which can break sessions or logins for code that handles multiple domains.

## CVEs

- CVE-2026-124249

## Timeline

- 2026-11-07: Vulnerability disclosed to the Security-announce list by Kirill Podoprigora
- 2026-11-09: Advisory posted to the oss-sec mailing list by Alan Coopersmith

## Coverage

- [CPython: [CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie](https://seclists.org/oss-sec/2026/q4/604) — Open Source Security, 2026-11-09

Tags: python, security, cookies, cve, http, cpython

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev