GHSA-gx76-c99x-2c96 CVE-2026-111749
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
- Severity
- 0.0 / 10
- Low · CVSS 4.0
- Exploit chance (EPSS)
- 0.38%
- Chance of exploitation in the next 30 days. Higher than 32.46% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-565 Reliance on Cookies without Validation and Integrity Checking
- Fix
3.14.4- Upgrade aiohttp to this version or later
Description
Summary
A subdomain can remove the Host-Only flag from an existing cookie to a parent domain.
Impact
A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| aiohttp | < 3.14.4 |
3.14.4 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
aiohttp PyPI → 3.14.4
- pip
pip install --upgrade "aiohttp>=3.14.4"- poetry
poetry add "aiohttp>=3.14.4"- uv
uv add "aiohttp>=3.14.4"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-565: Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
How to prevent it
- Architecture and Design: Avoid using cookie data for a security-related decision.
- Implementation: Perform thorough input validation (i.e.: server side validation) on the cookie data if you're going to use it for a security related decision.
- Architecture and Design: Add integrity checks to detect tampering.
- Architecture and Design: Protect critical cookies from replay attacks, since cross-site scripting or other attacks may allow attackers to steal a strongly-encrypted cookie that also passes integrity checks. This mitigation applies to cookies that should only be valid during a single transaction or session. By enforcing timeouts, you may limit the scope of an attack. As part of your integrity check, use an unpredictable, server-side value that is not exposed to the client.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-pqxq-w44r-73xw AIOHTTP: Pure-Python parser request smuggling | Medium | Also affects aiohttp |
| GHSA-f9xw-jh8m-3mwq AIOHTTP: Absolute-form request targets can spoof Request.scheme | Medium | Also affects aiohttp |
| GHSA-9xw5-w5jj-pvcg AIOHTTP: File descriptor exhaustion in multipart requests | High | Also affects aiohttp |
| GHSA-6cjc-53gc-5rqm AIOHTTP: Connector pool exhaustion via Max-Age overflow | Medium | Also affects aiohttp |
| GHSA-5wr8-gcqf-gqf3 aiohttp server lacks an initial request/header timeout | High | Also affects aiohttp |
| GHSA-494j-54xm-rwp3 AIOHTTP: Secure attribute not enforced for shared cookie | Medium | Also affects aiohttp |
| GHSA-2g87-pp6c-29x5 aiohttp: Multiple instances of excessive or unbounded memory/CPU use | High | Also affects aiohttp |
| GHSA-cq5v-8q36-5273 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) | High | Also affects aiohttp |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor