CVE-2026-124249
2026-11-09
15h17 +00:00
15h17 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
http.cookiejar.CookieJar deleted a stored cookie when a response carried an
already expired Set-Cookie header for it, using the Domain and Path
attributes from the header without consulting the cookie policy. A server
could therefore delete cookies belonging to other domains from a shared
cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix
consults the cookie policy before an expired cookie may delete an existing
one, as required by RFC 6265 section 5.3.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Origin Validation Error The product does not properly verify that the source of data or communication is valid. |
