CVE-2026-111749

Summary

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

Severity

low

EPSS

0.4% (p32)

CWE

CWE-565

Also known as

GHSA-gx76-c99x-2c96

Published

2026-10-20

Updated

2026-10-20

Advisory details

Summary

A subdomain can remove the Host-Only flag from an existing cookie to a parent domain.

Impact

A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.

References

• https://github.com/advisories/GHSA-gx76-c99x-2c96
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gx76-c99x-2c96
• https://nvd.nist.gov/vuln/detail/CVE-2026-111749
• https://github.com/aio-libs/aiohttp/commit/6a07c171ef9f3be583e2907dcd1931372efca8d6
• https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4

Related advisories

• CVE-2026-111066 — high · PyPI/aiohttp
• CVE-2026-111064 — high · PyPI/aiohttp
• GHSA-2g87-pp6c-29x5 — high · PyPI/aiohttp
• CVE-2026-69244 — high · PyPI/aiohttp
• CVE-2025-69223 — high · PyPI/aiohttp
• CVE-2026-111748 — medium · PyPI/aiohttp
• CVE-2026-111065 — medium · PyPI/aiohttp
• CVE-2026-111750 — medium · PyPI/aiohttp

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity