## AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

- 種別: advisory
- 重大度: low
- 関連技術: python
- CVE: CVE-2026-111749
- 公開日時: 2026-10-20T19:58:14.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-gx76-c99x-2c96)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-gx76-c99x-2c96

影響: pip:aiohttp <= 3.14.3 → 3.14.4
Summary A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. Impact A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.