GHSA-2fqr-mr3j-6wp8 CVE-2026-54279 PYSEC-2026-2112
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.49%
- Chance of exploitation in the next 30 days. Higher than 42.38% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-665 Improper Initialization
- Fix
3.14.1- Upgrade aiohttp to this version or later
Description
Summary
Host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status.
Impact
Host-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed.
Patch: https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| aiohttp | < 3.14.1 |
3.14.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
aiohttp PyPI → 3.14.1
- pip
pip install --upgrade "aiohttp>=3.14.1"- poetry
poetry add "aiohttp>=3.14.1"- uv
uv add "aiohttp>=3.14.1"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- Low
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Unreported
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
How to prevent it
- Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
- Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
- Implementation: Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
- Implementation: Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
- Implementation: Avoid race conditions (CWE-362) during initialization routines.
- Build and Compilation: Run or compile your product with settings that generate warnings about uninitialized variables or data.
References
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-pqxq-w44r-73xw AIOHTTP: Pure-Python parser request smuggling | Medium | Also affects aiohttp |
| GHSA-gx76-c99x-2c96 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies | Low | Also affects aiohttp |
| GHSA-f9xw-jh8m-3mwq AIOHTTP: Absolute-form request targets can spoof Request.scheme | Medium | Also affects aiohttp |
| GHSA-9xw5-w5jj-pvcg AIOHTTP: File descriptor exhaustion in multipart requests | High | Also affects aiohttp |
| GHSA-6cjc-53gc-5rqm AIOHTTP: Connector pool exhaustion via Max-Age overflow | Medium | Also affects aiohttp |
| GHSA-5wr8-gcqf-gqf3 aiohttp server lacks an initial request/header timeout | High | Also affects aiohttp |
| GHSA-494j-54xm-rwp3 AIOHTTP: Secure attribute not enforced for shared cookie | Medium | Also affects aiohttp |
| GHSA-2g87-pp6c-29x5 aiohttp: Multiple instances of excessive or unbounded memory/CPU use | High | Also affects aiohttp |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor