Is CVE-2026-124249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124249 being exploited in the wild.

How severe is CVE-2026-124249?

Informational severity, published 9 November 2026.

Which products and versions are affected?

Python CPython 3.11, 3.12, 3.13, 3.14, 3.15, 3.16.

Is there a fix for CVE-2026-124249?

Yes: fixed in CPython 3.11, 3.12, 3.13, 3.14, 3.15, 3.16 (via backports gh-161581, gh-161582, gh-161583, gh-161580, gh-161579, and main branch respectively). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124249 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-124249?

Check whether you run Python CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124249: Python http.cookiejar cookie deletion policy bypass

CVE-2026-124249 · Severity: info · Published 2026-11-09

Python's http.cookiejar module, used by urllib to manage HTTP cookies in web requests, allows a server to delete cookies belonging to other domains from a shared cookie jar by sending an expired Set-Cookie header. An attacker controlling a web server could exploit this to delete session cookies or authentication cookies from other sites that a user has visited, potentially forcing re-authentication or disrupting user sessions across multiple services.

Technologies: Python CPython. Vendors: Python.

Quick answers

Is CVE-2026-124249 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124249 being exploited in the wild.
How severe is CVE-2026-124249?: Informational severity, published 9 November 2026.
Which products and versions are affected?: Python CPython 3.11, 3.12, 3.13, 3.14, 3.15, 3.16.
Is there a fix for CVE-2026-124249?: Yes: fixed in CPython 3.11, 3.12, 3.13, 3.14, 3.15, 3.16 (via backports gh-161581, gh-161582, gh-161583, gh-161580, gh-161579, and main branch respectively). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124249 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-124249?: Check whether you run Python CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: CPython 3.11, 3.12, 3.13, 3.14, 3.15, 3.16 (via backports gh-161581, gh-161582, gh-161583, gh-161580, gh-161579, and main branch respectively)

Technical details

The http.cookiejar.CookieJar class failed to consult the CookiePolicy before allowing an expired Set-Cookie header to delete an existing stored cookie, instead using the Domain and Path attributes directly from the server response. This allowed a malicious server to craft a response that deletes cookies belonging to any other domain in a shared jar, violating RFC 6265 section 5.3. The fix adds a policy check (CookiePolicy.set_ok()) before permitting an expired cookie to delete an existing one.

Affected products

Python CPython 3.11, 3.12, 3.13, 3.14, 3.15, 3.16

Timeline

2026-11-07: disclosed: Issue reported
2026-11-07: patched: Patch merged to main branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.