GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-160300: Reject cookies with a negative version in http.cookiejar by gpshead · Pull Request #160301 · python/cpython

Conversation

gpshead commented Oct 22, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

DefaultCookiePolicy only applied its domain checks to cookies with version 0 or a positive version, so a cookie with a negative Version attribute was accepted for, and returned to, a domain unrelated to the server that set it. Negative versions are now treated as invalid: the Set-Cookie header is ignored when parsed, like a non-numeric version already is, and set_ok_version() and return_ok_version() return false, which also covers cookies added with set_cookie() or loaded from a file saved earlier.

ANT-2026-TA36I7V7

Issue: http.cookiejar skips domain checks for cookies with a negative Version #160300

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

gpshead added needs backport to 3.11

only security fixes

needs backport to 3.12

only security fixes

needs backport to 3.13

only security fixes

needs backport to 3.14

bugs and security fixes

needs backport to 3.15 bugs and security fixes labels

Oct 22, 2026

gpshead self-assigned this

Oct 22, 2026

bedevere-app Bot mentioned this pull request

Oct 22, 2026

http.cookiejar skips domain checks for cookies with a negative Version #160300

Closed

gpshead requested a review from JelleZijlstra

October 22, 2026 18:46

gpshead marked this pull request as ready for review

October 22, 2026 18:46

bedevere-app Bot added the awaiting core review label

Oct 22, 2026

StanFromIreland reviewed

Oct 22, 2026

View reviewed changes

Comment thread

Misc/NEWS.d/next/Security/2026-10-22-08-04-33.gh-issue-160300.q7Zk2B.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

JelleZijlstra approved these changes

Oct 22, 2026

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting core review labels

Oct 22, 2026

gpshead added the sprint label

Oct 23, 2026

github-project-automation Bot added this to Sprint

Oct 23, 2026

github-project-automation Bot moved this to Todo in Sprint

Oct 23, 2026

github-project-automation Bot moved this from Todo to In Progress in Sprint

Oct 23, 2026

gpshead removed this from Sprint

Oct 25, 2026

gpshead removed the sprint label

Oct 25, 2026

gpshead added 2 commits

October 25, 2026 06:23


          pythongh-160300: Reject cookies with a negative version in http.cooki…

fea9926

…ejar

DefaultCookiePolicy only applied its domain checks to cookies with
version 0 or a positive version.

ANT-2026-TA36I7V7


          Use neutral domain names in test_wrong_domain

4b129a7

Match the domains used by test_negative_version.

gpshead force-pushed the scanfix-cookiejar-ta36i7v7 branch from f561420 to 4b129a7 Compare

October 25, 2026 06:25

gpshead enabled auto-merge (squash)

October 25, 2026 06:36

gpshead merged commit d59d968 into python:main

Oct 25, 2026

53 checks passed

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Oct 25, 2026

Copy link

Copy Markdown

Thanks @gpshead for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label

Oct 25, 2026

gpshead added a commit that referenced this pull request

Oct 25, 2026


          [3.15] gh-160300: Reject cookies with a negative version in http.cook…

1b5a6f7

…iejar (GH-160301) (#160645)

gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301)

DefaultCookiePolicy only applied its domain checks to cookies with
version 0 or a positive version.

ANT-2026-TA36I7V7
(cherry picked from commit d59d968)

Co-authored-by: Gregory P. Smith <[email protected]>

gpshead added a commit that referenced this pull request

Oct 25, 2026


          [3.14] gh-160300: Reject cookies with a negative version in http.cook…

2473e7a

…iejar (GH-160301) (#160646)

gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301)

DefaultCookiePolicy only applied its domain checks to cookies with
version 0 or a positive version.

ANT-2026-TA36I7V7
(cherry picked from commit d59d968)

Co-authored-by: Gregory P. Smith <[email protected]>

StanFromIreland reviewed

Oct 25, 2026

View reviewed changes

Comment thread

Misc/NEWS.d/next/Security/2026-10-22-08-04-33.gh-issue-160300.q7Zk2B.rst

StanFromIreland Oct 25, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@gpshead can we please try to include the CVE number in the entry in the future, for people downstream?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Yhg1s pushed a commit that referenced this pull request

Oct 25, 2026


          [3.13] gh-160300: Reject cookies with a negative version in http.cook…

b4198a8

…iejar (GH-160301) (#160647)

gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301)

DefaultCookiePolicy only applied its domain checks to cookies with
version 0 or a positive version.

ANT-2026-TA36I7V7
(cherry picked from commit d59d968)

Co-authored-by: Gregory P. Smith <[email protected]>

Yhg1s pushed a commit that referenced this pull request

Oct 25, 2026


          [3.12] gh-160300: Reject cookies with a negative version in http.cook…

673da87

…iejar (GH-160301) (#160648)

gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301)

DefaultCookiePolicy only applied its domain checks to cookies with
version 0 or a positive version.

ANT-2026-TA36I7V7
(cherry picked from commit d59d968)

Co-authored-by: Gregory P. Smith <[email protected]>

pablogsal pushed a commit that referenced this pull request

Oct 25, 2026


          [3.11] gh-160300: Reject cookies with a negative version in http.cook…

…iejar (GH-160301) (#160649)

gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301)

DefaultCookiePolicy only applied its domain checks to cookies with
version 0 or a positive version.

ANT-2026-TA36I7V7
(cherry picked from commit d59d968)

Co-authored-by: Gregory P. Smith <[email protected]>

icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request

Oct 28, 2026


          [3.11] pythongh-160300: Reject cookies with a negative version in htt…

ed638dc

…p.cookiejar (pythonGH-160301) (python#160649)

pythongh-160300: Reject cookies with a negative version in http.cookiejar (pythonGH-160301)

DefaultCookiePolicy only applied its domain checks to cookies with
version 0 or a positive version.

ANT-2026-TA36I7V7
(cherry picked from commit d59d968)

Co-authored-by: Gregory P. Smith <[email protected]>
(cherry picked from commit 6229895)

icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request

Oct 28, 2026


          [3.11] pythongh-160300: Reject cookies with a negative version in htt…

ac2bf3d

…p.cookiejar (pythonGH-160301) (python#160649)

pythongh-160300: Reject cookies with a negative version in http.cookiejar (pythonGH-160301)

DefaultCookiePolicy only applied its domain checks to cookies with
version 0 or a positive version.

ANT-2026-TA36I7V7
(cherry picked from commit d59d968)

Co-authored-by: Gregory P. Smith <[email protected]>
(cherry picked from commit 6229895)
(cherry picked from commit cd2a617)

Reviewers

StanFromIreland

StanFromIreland left review comments

JelleZijlstra

JelleZijlstra approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

gpshead

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

gpshead commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

miss-islington-app Bot commented Oct 25, 2026

Uh oh!

bedevere-app Bot commented Oct 25, 2026

Uh oh!

bedevere-app Bot commented Oct 25, 2026

Uh oh!

bedevere-app Bot commented Oct 25, 2026

Uh oh!

bedevere-app Bot commented Oct 25, 2026

Uh oh!

bedevere-app Bot commented Oct 25, 2026

Uh oh!

StanFromIreland Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gpshead commented Oct 22, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.