CVE-2026-111749: AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
Summary
A subdomain can remove the Host-Only flag from an existing cookie to a parent domain.
Impact
A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4 - Upgrade
Upgrade
AIOHTTPto a version that resolves this vulnerability.Fixed in 3.14.4
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using aiohttp before 3.14.4 are exposed if users can access an untrusted subdomain and the application relies on host-only cookie protections. The practical impact is limited when the application does not reflect those cookies to a browser.
What must an attacker do to exploit it?
The attacker needs a user to access an untrusted subdomain. That subdomain can remove the host-only scope from an existing cookie set for the parent domain.
What should teams do to remediate the issue?
Upgrade aiohttp to version 3.14.4, which fixes the issue. If upgrading cannot happen immediately, avoid allowing users to access untrusted subdomains where host-only cookie protections are relied upon.