UBUNTU-CVE-2026-124249: Medium severity ubuntu/python2.7 vulnerability
http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.
Affected Software
Event History
Frequently Asked Questions
Which applications are most exposed to this issue?
Applications that use a shared http.cookiejar.CookieJar across requests to different domains are most exposed. The description specifically identifies cookie jars used by urllib's HTTPCookieProcessor as an example.
What does an attacker need to do to exploit the issue?
The attacker needs to cause the client to process a response containing an already expired Set-Cookie header. The header can use Domain and Path attributes that target a cookie belonging to another domain in the shared cookie jar.
What behavior does the fix change?
The fix requires the cookie policy to be consulted before an expired cookie can delete an existing stored cookie. This aligns expired-cookie deletion handling with RFC 6265 section 5.3.