{"id":"CVE-2022-23607","aliases":["GHSA-fhpf-pp6p-55qc","PYSEC-2022-26"],"url":"https://o3.security/vulnerability/CVE-2022-23607","summary":"Unsafe handling of user-specified cookies in treq","details":"### Impact\n\nTreq's request methods (`treq.get`, `treq.post`, `HTTPClient.request`, `HTTPClient.get`, etc.) accept cookies as a dictionary, for example:\n\n```py\ntreq.get('https://example.com/', cookies={'session': '1234'})\n```\n\nSuch cookies are not bound to a single domain, and are therefore sent to *every* domain (\"supercookies\"). This can potentially cause sensitive information to leak upon an HTTP redirect to a different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the latter will receive the cookie `session`.\n\n### Patches\n\nTreq 2021.1.0 and later bind cookies given to request methods (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url* parameter.\n\n### Workarounds\n\nInstead of passing a dictionary as the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped cookies in it:\n\n```py\nfrom http.cookiejar import CookieJar\nfrom requests.cookies import create_cookie\n\njar = CookieJar()\njar.add_cookie(\n    create_cookie(\n        name='session',\n        value='1234',\n        domain='example.com',\n        secure=True,\n    ),\n)\nclient = HTTPClient(cookies=jar)\nclient.get('https://example.com/')\n```\n\n### References\n\n* Originally reported at [huntr.dev](https://huntr.dev/bounties/3c9204fc-a3d1-4441-8599-924c5f57e7ae/?token=06d930e37046c914bcb037e85cc227dc7b510b475989fc69837566562ba899277d46b0fb4b1e21cdcb6ddc1b7d9b1ded632cf3a3551ecb89afca16a63b34641284b50479d5195bba2ac09b116f3dd4fad27f54404c2de922c05c8c8b744aec27bb4d4d198cb8b3abf479af0c2d5fbaa10412da7922594ac3eb39)\n* A related issue in the handling of HTTP basic authentication was addressed in Twisted 22.1 ([GHSA-92x2-jw7w-xvvx](https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx), CVE-2022-21712).","published":"2022-02-01T11:01:07Z","modified":"2026-08-12T03:51:08.544277339Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},"epss":{"score":0.01083,"percentile":0.61893,"asOf":"2026-08-03"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"treq","fixedVersion":"22.1.0"}],"fix":{"url":"https://github.com/twisted/treq/commit/1da6022cc880bbcff59321abe02bf8498b89efb2","label":"twisted/treq@1da6022"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23607.json"},{"type":"ADVISORY","url":"https://github.com/twisted/treq/security/advisories/GHSA-fhpf-pp6p-55qc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23607"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00025.html"},{"type":"WEB","url":"https://github.com/twisted/treq/commit/1da6022cc880bbcff59321abe02bf8498b89efb2"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/treq/PYSEC-2022-26.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/treq"},{"type":"WEB","url":"https://github.com/twisted/treq/releases/tag/release-22.1.0"},{"type":"WEB","url":"https://huntr.dev/bounties/3c9204fc-a3d1-4441-8599-924c5f57e7ae/?token=06d930e37046c914bcb037e85cc227dc7b510b475989fc69837566562ba899277d46b0fb4b1e21cdcb6ddc1b7d9b1ded632cf3a3551ecb89afca16a63b34641284b50479d5195bba2ac09b116f3dd4fad27f54404c2de922c05c8c8b744aec27bb4d4d198cb8b3abf479af0c2d5fbaa10412da7922594ac3eb39"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:08.544277339Z"}}