{"id":"ghsa-ghsa-gx76-c99x-2c96","seq":2394,"kind":"advisory","title":"AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies","url":"https://github.com/advisories/GHSA-gx76-c99x-2c96","permalink":"https://vulnpulse.app/items/ghsa-ghsa-gx76-c99x-2c96","summary":"影響: pip:aiohttp <= 3.14.3 → 3.14.4\nSummary A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. Impact A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.","severity":"low","techs":["python"],"cves":["CVE-2026-111749"],"tags":["GHSA-gx76-c99x-2c96","aiohttp"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T19:58:14.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}