CVE-2026-124249

EUVD-2026-120068
http.cookiejar.CookieJar deleted a stored cookie when a response carried an
already expired Set-Cookie header for it, using the Domain and Path
attributes from the header without consulting the cookie policy. A server
could therefore delete cookies belonging to other domains from a shared
cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix
consults the cookie policy before an expired cookie may delete an existing
one, as required by RFC 6265 section 5.3.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
PSFCNA
6.3 MEDIUM
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
pythoncpython
𝑥
< 3.16.0
CNA
Common Weakness Enumeration
References
https://github.com/python/cpython/issues/161569
https://github.com/python/cpython/pull/161570
https://mail.python.org/archives/list/security-announce@python.org/thread/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/