AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
影響: pip:aiohttp <= 3.14.3 → 3.14.4
A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. Impact A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.
Read on GitHub Advisory Database
| CVE | CVE-2026-111749 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/22/2026, 01:17 AM |
| Data | Markdown JSON |
On 10/21/2026, 04:58 AM, GitHub Advisory Database published "AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies" (type: Advisory). Severity is "Low" (low). Related technologies: Python. CVE: CVE-2026-111749.