AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

影響: pip:aiohttp <= 3.14.3 → 3.14.4

A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. Impact A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.

在 GitHub Advisory Database 阅读

2026/10/21 04:58，GitHub Advisory Database 发布了“AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：Python。CVE：CVE-2026-111749。