{"id":"CVE-2026-124249","published":"2026-11-09T15:17:14.963","lastModified":"2026-11-11T01:17:13.863","description":"http.cookiejar.CookieJar deleted a stored cookie when a response carried an\nalready expired Set-Cookie header for it, using the Domain and Path\nattributes from the header without consulting the cookie policy. A server\ncould therefore delete cookies belonging to other domains from a shared\ncookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix\nconsults the cookie policy before an expired cookie may delete an existing\none, as required by RFC 6265 section 5.3.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-346"],"vendors":[],"products":[],"references":[{"url":"https://github.com/python/cpython/commit/4e9d037f1cfc8e29efcb1f67bc668e06ff2b6643","tags":[]},{"url":"https://github.com/python/cpython/commit/8eb3d2c1c41ca7ce628554413981c1eb763a1494","tags":[]},{"url":"https://github.com/python/cpython/commit/ac1d49f4fbb33941475c5aa3cb663ab39d64cb73","tags":[]},{"url":"https://github.com/python/cpython/issues/161569","tags":[]},{"url":"https://github.com/python/cpython/pull/161570","tags":[]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/24","tags":[]}],"exploitRefs":[{"url":"https://github.com/python/cpython/commit/4e9d037f1cfc8e29efcb1f67bc668e06ff2b6643","tags":[]},{"url":"https://github.com/python/cpython/commit/8eb3d2c1c41ca7ce628554413981c1eb763a1494","tags":[]},{"url":"https://github.com/python/cpython/commit/ac1d49f4fbb33941475c5aa3cb663ab39d64cb73","tags":[]},{"url":"https://github.com/python/cpython/issues/161569","tags":[]},{"url":"https://github.com/python/cpython/pull/161570","tags":[]}],"hasPoc":true,"ai":null}