Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.
Published: 2026-10-19
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Cookie Scope Removal
Action: Patch ASAP
AI Analysis

Impact

This vulnerability permits a subdomain to remove the host‑only restriction from a cookie that originally had a parent‑domain scope. The cookie loses the host‑only attribute and may be sent to other subdomains. The impact is limited to situations where the application forwards the modified cookie to a client browser; if the application does not surface the altered cookie, there is no direct effect on the browser. The issue was addressed in aiohttp 3.14.4, which restores proper handling of host‑only scopes. The weakness corresponds to the issues highlighted by CWE‑346 and CWE‑565.

Affected Systems

The flaw affects any installation of the aio-libs:aiohttp asynchronous HTTP framework running a version earlier than 3.14.4. All applications that rely on aiohttp for HTTP handling, whether in client or server mode, are at risk until they upgrade to the patched release.

Risk and Exploitability

The CVSS score of 2.3 indicates a low severity impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote user accessing a malicious or untrusted subdomain that triggers the cookie modification. Exploitation requires that the application propagate the altered cookie to a browser; if the application does not send cookies to the client, the threat is further mitigated.

Generated by OpenCVE AI on October 20, 2026 at 07:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade aiohttp to version 3.14.4 or later.
  • Verify that no untrusted subdomains are allowed to set cookies that will be forwarded to browsers.
  • Audit application code to ensure that host‑only cookie attributes are correctly set and that cookies from untrusted origins are not propagated to clients.

Generated by OpenCVE AI on October 20, 2026 at 07:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-gx76-c99x-2c96 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-346
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}

threat_severity

Moderate

Mon, 19 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Aio-libs
Aio-libs aiohttp
Vendors & Products Aio-libs
Aio-libs aiohttp

Mon, 19 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.
Title AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
Weaknesses CWE-565
References
Metrics cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Aio-libs Aiohttp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-22T20:52:37.188Z

Reserved: 2026-10-16T17:52:09.081Z

Link: CVE-2026-111749

cve-icon Vulnrichment

Updated: 2026-10-22T20:52:33.369Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-19T17:17:04.023

Modified: 2026-10-22T21:17:14.683

Link: CVE-2026-111749

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-19T17:04:42Z

Links: CVE-2026-111749 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T07:30:11Z

Weaknesses
  • CWE-346

    Origin Validation Error

  • CWE-565

    Reliance on Cookies without Validation and Integrity Checking