{"id":"PSF-2019-17","aliases":[],"status":"published","title":"http.cookiejar: Incorrect validation of path","description":"Cookies of ``example.com`` with ``path=/any`` were sent to\n``example.com/anybad/`` while using a cookiejar with\n`http.cookiejar.DefaultCookiePolicy` policy. The code did not check for\nthe first non-matching character in prefix match to be a slash.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2019-01-03T00:00:00Z","modified":"2025-10-09T01:00:06Z","references":[{"url":"https://bugs.python.org/issue35647","tags":["report"]}],"sources":{"osv":[{"id":"PSF-2019-17","title":"http.cookiejar: Incorrect validation of path","description":"Cookies of ``example.com`` with ``path=/any`` were sent to\n``example.com/anybad/`` while using a cookiejar with\n`http.cookiejar.DefaultCookiePolicy` policy. The code did not check for\nthe first non-matching character in prefix match to be a slash.\n","status":"published","published":"2019-01-03T00:00:00Z","modified":"2025-10-09T01:00:06.232851Z","updated_at":"2026-11-02T15:52:50.263679Z"}]}}