The vulnerability lies in http.cookiejar's handling of expired Set-Cookie headers; when such a header arrives, the library deletes a cookie whose domain and path match the header using only the cookie policy, without first verifying whether the cookie actually exists or is valid. This allows a malicious server to send an expired Set-Cookie for a domain different from its own, causing the cookie store to remove a cookie that belongs to another domain. The consequence is the loss of valid authentication cookies or other sensitive data that the application relies on, potentially denying users access to legitimate services. The weakness is identified as CWE-346 because the software fails to enforce proper access control on cookie deletion.

The issue affects CPython, the reference implementation of Python, particularly any use of urllib's HTTPCookieProcessor that shares a cookie jar across domains. No specific CPython version is listed in the advisory, so all installations using the affected cookiejar code should be examined for the presence of the patch commit.

The CVSS score of 6.3 classifies the flaw as moderately severe. While the EPSS score is not published, the vulnerability’s impact is localized to processes that maintain a shared cookie jar, and an attacker would need to provoke the client into processing a crafted HTTP response containing an expired Set-Cookie for a different domain. The KEV catalog notes this is not currently part of any known exploit set. The attack vector is therefore likely an HTTP request/response attack against an application that relies on urllib for network communication.