medium
advisory
CPython: http.cookiejar deletes cookies of other domains via expired Set-Cookie (CVE-2026-124249)
CPython's http.cookiejar module is vulnerable to the deletion of cookies belonging to other domains when an expired Set-Cookie header is processed.
CVE search metadata
CVE search record: CVE-2026-124249. KEV: no. Product: CPython. Brief: CPython: http.cookiejar deletes cookies of other domains via expired Set-Cookie (CVE-2026-124249). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cpython-cookiejar-vuln/
Triage facts
Revision 1- Applicability
- CPython
- Evidence
- Not observed
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 23:17 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Unknown
A security vulnerability (CVE-2026-124249) has been identified in the CPython http.cookiejar module. The module improperly handles expired Set-Cookie headers, resulting in the deletion of cookies associated with other domains.