Cookie Management Flaw in Python's HTTPCookieProcessor
CVE-2026-124249

6.3MEDIUM

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124249?

A vulnerability in Python's HTTPCookieProcessor allows a server to delete cookies from a shared cookie jar when an expired Set-Cookie header is sent. Specifically, the cookie management system did not adequately check the cookie policy before allowing an expired cookie to remove existing cookies. This flaw could potentially allow for unauthorized cookie deletion across different domains, emphasizing the need for strict compliance with the cookie policy as outlined in RFC 6265, section 5.3.

Affected Version(s)

CPython 0 < 3.16.0

References

https://github.com/python/cpython/pull/161570
patch
https://github.com/python/cpython/issues/161569
issue-tracking
https://mail.python.org/archives/list/security-announce@p...
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Grant Abejar (https://github.com/vinzabe)
Kirill Podoprigora (https://github.com/Eclips4)
Victor Stinner (https://github.com/vstinner)
.