Live › vulnerability › CVE-2026-54279
aiohttp's CookieJar loses the host-only flag on cookies it restores from disk via load(). Those cookies can then be sent to subdomains that should not receive them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:30 UTC, 0h before NVD. All times on this page are UTC.
Applications that use aiohttp's CookieJar save() and load() to persist cookies between runs, and then make requests to subdomains of the host that set the cookie. Code that does not persist its cookie jar to disk is not affected by this description.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| aiohttp | pypi | <= 3.14.0 | 3.14.1 |
| aiohttp | vendor | < 3.14.1 | 3.14.1 |
pip show aiohttp and compare the version to 3.14.0CookieJar together with .load( or .save(aiohttp 3.14.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status.
Host-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed.
Patch: https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2
This page as .md · .json · in your agent: get_signal("CVE-2026-54279")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.