AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

影響: pip:aiohttp <= 3.14.3 → 3.14.4

A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. Impact A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.

GitHub Advisory Databaseで読む

2026/10/21 04:58、GitHub Advisory Databaseが「AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: Python。CVE: CVE-2026-111749。