All vulnerabilities
CVE-2026-111749GHSA-gx76-c99x-2c96

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

aio-libs aiohttppipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
2.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.14.4Fixed versionGitHub
Published19 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 3.14.4aiohttp, pipGitHub
  • 3.14.4aiohttp, PyPIOSVpip install "aiohttp>=3.14.4"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

A subdomain can remove the Host-Only flag from an existing cookie to a parent domain.

Impact

A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.

Text from GitHub Advisory Database

Affected versions 53

  • aiohttp, pip<= 3.14.3GitHub
  • aiohttpaffected: < 3.14.4CVE List
  • aiohttp, PyPIfrom first release, fixed in 3.14.4OSV
  • aiohttp, PyPI0.1OSV
  • aiohttp, PyPI0.10.0OSV
  • aiohttp, PyPI0.10.1OSV
  • aiohttp, PyPI0.10.2OSV
  • aiohttp, PyPI0.11.0OSV
  • aiohttp, PyPI0.12.0OSV
  • aiohttp, PyPI0.13.0OSV
  • aiohttp, PyPI0.13.1OSV
  • aiohttp, PyPI0.14.0OSV
  • aiohttp, PyPI0.14.1OSV
  • aiohttp, PyPI0.14.2OSV
  • aiohttp, PyPI0.14.3OSV
  • aiohttp, PyPI0.14.4OSV
  • aiohttp, PyPI0.15.0OSV
  • aiohttp, PyPI0.15.1OSV
  • aiohttp, PyPI0.15.2OSV
  • aiohttp, PyPI0.15.3OSV
  • aiohttp, PyPI0.16.0OSV
  • aiohttp, PyPI0.16.1OSV
  • aiohttp, PyPI0.16.2OSV
  • aiohttp, PyPI0.16.3OSV
  • aiohttp, PyPI0.16.4OSV
  • aiohttp, PyPI0.16.5OSV
  • aiohttp, PyPI0.16.6OSV
  • aiohttp, PyPI0.17.0OSV
  • aiohttp, PyPI0.17.1OSV
  • aiohttp, PyPI0.17.2OSV
  • aiohttp, PyPI0.17.3OSV
  • aiohttp, PyPI0.17.4OSV
  • aiohttp, PyPI0.18.0OSV
  • aiohttp, PyPI0.18.1OSV
  • aiohttp, PyPI0.18.2OSV
  • aiohttp, PyPI0.18.3OSV
  • aiohttp, PyPI0.18.4OSV
  • aiohttp, PyPI0.19.0OSV
  • aiohttp, PyPI0.2OSV
  • aiohttp, PyPI0.20.0OSV
  • aiohttp, PyPI0.20.1OSV
  • aiohttp, PyPI0.20.2OSV
  • aiohttp, PyPI0.21.0OSV
  • aiohttp, PyPI0.21.1OSV
  • aiohttp, PyPI0.21.2OSV
  • aiohttp, PyPI0.21.4OSV
  • aiohttp, PyPI0.21.5OSV
  • aiohttp, PyPI0.21.6OSV
  • aiohttp, PyPI0.22.0OSV
  • aiohttp, PyPI0.22.0a0OSV
  • aiohttp, PyPI0.22.0b0OSV
  • aiohttp, PyPI0.22.0b1OSV
  • aiohttp, PyPI0.22.0b2OSV

References 5