Cookie Protection Flaw in AIOHTTP Framework by AIO-Libs
CVE-2026-111749

2.3LOW

Key Information:

Vendor

Aio-libs

Status
Aiohttp
Vendor
CVE Published:
19 October 2026

What is CVE-2026-111749?

AIOHTTP, an asynchronous HTTP client/server framework for Python, is susceptible to a vulnerability where a subdomain can remove the Host-Only scope from an existing parent-domain cookie. This occurs when a user interacts with an untrusted subdomain, leading to potential exposure of cookie security protections. The impact remains limited when applications do not relay these cookies to a web browser. This issue has been addressed in version 3.14.4, making it essential for developers to update to ensure robust cookie protection.

Affected Version(s)

aiohttp < 3.14.4

References

https://github.com/aio-libs/aiohttp/security/advisories/G...
x_refsource_CONFIRM
https://github.com/aio-libs/aiohttp/commit/6a07c171ef9f3b...
x_refsource_MISC
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.