CVE-2026-111749
Received Received - Intake

Host-Only Cookie Scope Bypass in AIOHTTP

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111749
EUVD
EUVD-2026-104485

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aio-libs aiohttp < 3.14.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-565 The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

AIOHTTP is an asynchronous HTTP framework for Python. The vulnerability allows a subdomain to remove the Host-Only flag from cookies set for a parent domain. This flag restricts cookies to the specific host, preventing them from being sent to other domains. The issue exists in versions before 3.14.4.

Detection Guidance

To detect this vulnerability, check if your aiohttp version is below 3.14.4. Run: pip show aiohttp. If the version is <=3.14.3, the system is vulnerable. Additionally, review cookie handling in applications using aiohttp to ensure Host-Only flags are properly set.

Impact Analysis

If you access an untrusted subdomain, an attacker could remove the Host-Only protection from your cookies. This might expose cookies to unintended domains, though impact is limited if applications do not reflect these cookies to browsers.

Mitigation Strategies

Upgrade aiohttp to version 3.14.4 or later immediately. Use pip install --upgrade aiohttp==3.14.4. Review and update cookie policies in applications to ensure Host-Only protections are enforced regardless of subdomain access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111749. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart