GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — `http.cookiejar` deletes cookies of other domains via expired Set-Cookie [CVE-2026-124249] · Issue #161569 · python/cpython

http.cookiejar deletes cookies of other domains via expired Set-Cookie [CVE-2026-124249] #161569

New issue
Copy link
New issue
Copy link
Open
Open
http.cookiejar deletes cookies of other domains via expired Set-Cookie [CVE-2026-124249]#161569
Copy link
Assignees
Eclips4
Labels
3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixes3.16new features, bugs and security fixesnew features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-securityA security issueA security issue

Description

@Eclips4
Eclips4
opened on Nov 7, 2026
Issue body actions

http.cookiejar.CookieJar deletes a stored cookie when a response carries an already expired Set-Cookie for it, without checking the cookie policy.
A server can therefore delete cookies belonging to other domains from a shared jar, which is the default for urllib's HTTPCookieProcessor.

RFC 6265, section 5.3, requires the domain check to happen before an existing cookie is removed. The fix consults CookiePolicy.set_ok() before an expired cookie is allowed to delete anything.

Linked PRs

  • gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar #161570
  • [3.15] gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar (GH-161570) #161579
  • [3.14] gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar (GH-161570) #161580
  • [3.13] gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar (GH-161570) #161581
  • [3.12] gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar (GH-161570) #161582
  • [3.11] gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar (GH-161570) #161583

Activity

  1. Eclips4
    self-assigned this
    on Nov 7, 2026
  2. Eclips4
    added
    type-securityA security issueA security issue
    stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory
    3.11only security fixesonly security fixes
    3.12only security fixesonly security fixes
    3.13only security fixesonly security fixes
    3.14bugs and security fixesbugs and security fixes
    3.15bugs and security fixesbugs and security fixes
    3.16new features, bugs and security fixesnew features, bugs and security fixes
    on Nov 7, 2026
  3. vstinner
    changed the title [-]`http.cookiejar` deletes cookies of other domains via expired Set-Cookie[/-] [+]`http.cookiejar` deletes cookies of other domains via expired Set-Cookie [CVE-2026-124249][/+] on Nov 7, 2026
  4. Eclips4
    added 3 commits that reference this issue on Nov 7, 2026

    gh-161569: Check cookie policy before deleting expired cookies in `ht…

    8eb3d2c

    [3.15] gh-161569: Check cookie policy before deleting expired cookies…

    4e9d037

    [3.14] gh-161569: Check cookie policy before deleting expired cookies…

    ac1d49f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

  • @Eclips4
    Eclips4

Labels

3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixes3.16new features, bugs and security fixesnew features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-securityA security issueA security issue

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.