PT-2026-140421
CVE-2026-124249
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
http.cookiejar.CookieJar deleted a stored cookie when a response carried an
already expired Set-Cookie header for it, using the Domain and Path
attributes from the header without consulting the cookie policy. A server
could therefore delete cookies belonging to other domains from a shared
cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix
consults the cookie policy before an expired cookie may delete an existing
one, as required by RFC 6265 section 5.3.
Found an issue in the description? Have something to add? Feel free to write us 👾