CVE-2026-124249 in Python
Summary
by MITRE • 11/09/2026
http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/09/2026
The vulnerability identified in Python’s http.cookiejar module represents a critical flaw in how cookies are managed within shared storage mechanisms like urllib's HTTPCookieProcessor. The core issue stems from the CookieJar class deleting stored cookies when it encounters an expired Set-Cookie header for that same cookie, but doing so without validating whether the incoming request and response contextually justify such deletion according to established web standards. Specifically, the implementation relied solely on the Domain and Path attributes present in the server's Set-Cookie header to determine which existing cookie should be removed. This approach bypassed the necessary checks performed by the associated CookiePolicy object, which is designed to enforce rules regarding domain matching, path validation, and security constraints such as secure-only or httponly flags.
This architectural oversight creates a significant cross-domain attack vector within applications that utilize shared cookie jars for managing HTTP state across multiple requests. Because the deletion logic did not consult the cookie policy before acting on an expired Set-Cookie directive, it allowed servers to manipulate cookies belonging to entirely different domains stored in the same jar. For instance, if an application fetches resources from both example.com and malicious-actor.com using a shared CookieJar, a response from malicious-actor.com containing an expired Set-Cookie header with Domain set to example.com could erroneously trigger the deletion of valid authentication or session cookies belonging to example.com. This behavior violates RFC 6265 section 5.3, which mandates that cookie attributes must be validated against policy rules before any modification to stored state occurs.
The operational impact of this vulnerability is severe for applications relying on persistent sessions and secure communication channels. Attackers who can inject or manipulate HTTP responses containing crafted Set-Cookie headers with expired timestamps could effectively log out users by stripping their active session cookies from the browser-like storage mechanism used by Python scripts. This leads to denial of service conditions where legitimate users are unexpectedly authenticated out, potentially causing data loss if unsaved work is discarded due to session termination. Furthermore, in scenarios involving sensitive operations such as financial transactions or administrative tasks, the sudden invalidation of credentials could disrupt critical workflows and expose systems to further exploitation attempts that rely on re-authentication prompts or state confusion.
From a classification perspective, this flaw aligns with CWE-20 Improper Input Validation, as the system failed to properly validate input data (the Set-Cookie header attributes) against expected security policies before executing destructive actions. It also relates to CWE-613 insufficient session management controls within the context of stateful protocol handling. In terms of adversary tactics, this vulnerability could be leveraged in ATT&CK technique T1557 Adversary-in-the-Middle if an attacker intercepts and modifies traffic to force cookie deletion, thereby facilitating credential theft or session hijacking by forcing re-authentication cycles that might leak information through timing attacks or phishing pages.
The resolution involves modifying the CookieJar implementation to strictly adhere to RFC 6265 requirements by ensuring that any decision to delete a stored cookie is first validated against the configured CookiePolicy instance. This ensures that domain and path attributes are checked for proper scope alignment before deletion proceeds, preventing cross-domain interference. To mitigate risks in environments where this vulnerability may still exist due to outdated library versions, developers should avoid sharing cookie jars across unrelated domains within the same process unless absolutely necessary. Implementing separate CookieJar instances per trusted domain or using isolated storage mechanisms can prevent one compromised endpoint from affecting others. Additionally, keeping Python installations updated with patched versions of the http module is essential to maintain integrity in automated web scraping tools and API clients that depend on consistent session management behavior.