GHSA-gx76-c99x-2c96: Pip/aiohttp vulnerability
Published Oct 20, 2026
·Updated
Summary
A subdomain can remove the Host-Only flag from an existing cookie to a parent domain.
Impact
A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.
Affected Software
1 affected componentFixes available
pip/aiohttp<=3.14.3
3.14.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4
Event History
Oct 20, 2026
Advisory Published
via GitHub·07:58 PM
Data Sourced
via GitHub·07:58 PM
DescriptionWeaknessAffected Software