CVE-2026-54279

AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Published Jun 22, 2026 CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

Analysis

Technical impact

Prior to version 3.14.1, aio-libs AIOHTTP mistakenly strips the host‑only flag from cookies when the CookieJar is saved and later restored, causing the cookies to be treated as domain cookies. This conversion can expose session identifiers or other sensitive data to a wider set of subdomains, potentially enabling attackers to read or hijack user session information. The bug is triggered only when CookieJar.save() and CookieJar.load() are used, and it is fixed in AIOHTTP 3.14.1.

Affected Systems

Any deployment of aio-libs AIOHTTP older than 3.14.1 that uses persistent cookie storage via CookieJar.save() or load() is impacted. The vulnerability does not depend on the operating system or specific Python environment, so all projects that import aiohttp and rely on that functionality are at risk.

Risk and Exploitability

The CVSS base score of 1.3 and the absence of an EPSS score or KEV listing indicate a very low overall risk. Exploitation requires local access to the persisted CookieJar or manipulation of the persistence process, limiting the attack surface to trusted users or compromised systems. While the flaw can lead to data leakage, the impact is constrained to cookie visibility and does not provide remote code execution or denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

aio-libs

aiohttp

affected

Version	Status	Constraints
`< 3.14.1`	affected	—

Configuration 1 [-]

cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Aio-libs

Aiohttp

Version	Status	Scheme	Platform
`[0,3.14.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to AIOHTTP 3.14.1 or later (the fix removes the downgrade of cookie scope)
Avoid persisting host‑only cookies that contain sensitive data; delete or neutralize them before calling CookieJar.save()
Restrict use of CookieJar persistence to trusted contexts and delete the persisted file after use
If an upgrade is not immediately available, manually strip the domain attribute from cookies before they are written to disk

Generated by OpenCVE AI on June 22, 2026 at 18:39 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4876-1	python-aiohttp security update
Github GHSA	GHSA-2fqr-mr3j-6wp8	aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.493% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8
https://nvd.nist.gov/vuln/detail/CVE-2026-54279
https://www.cve.org/CVERecord?id=CVE-2026-54279

History

Jun 25, 2026 12:45 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-54279 https://www.cve.org/CVERecord?id=CVE-2026-54279
Metrics	threat_severity `None`	threat_severity `Low`

Jun 22, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Aio-libs Aio-libs aiohttp
Vendors & Products		Aio-libs Aio-libs aiohttp

Jun 22, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 22, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.
Title		AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
Weaknesses		CWE-665
References		https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2 https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8
Metrics		cvssV4_0 `{'score': 1.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U'}`