Live › vulnerability › CVE-2026-111749
Go to dashboardAIOHTTP's cookie jar lets a subdomain remove the Host-Only flag from an existing cookie set for a parent domain, so the cookie becomes sent to the parent domain and its other subdomains. An attacker controlling a subdomain can strip that protection from cookies held by a client using the library.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| aiohttp | pypi | <= 3.14.3 | 3.14.4 |
Check whether the project pins aiohttp with pip show aiohttp or pip freeze | grep -i aiohttp and whether the version is 3.14.3 or lower.
Upgrade aiohttp to 3.14.4 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-111749")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.