GHSA-gx76-c99x-2c96

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

Source: GitHub Advisory Database (reviewed) Low CVE-2026-111749

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	aiohttp	< 3.14.4	3.14.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. ### Impact A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.

References

External links from the advisory. They lead to third-party sites.

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gx76-c99x-2c96 web
https://nvd.nist.gov/vuln/detail/CVE-2026-111749 advisory
https://github.com/aio-libs/aiohttp/commit/6a07c171ef9f3be583e2907dcd1931372efca8d6 web
https://github.com/aio-libs/aiohttp package
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4 web