CVE-2026-111749

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

CVE-2026-111749

The AIOHTTP asynchronous HTTP client/server framework for Python and asyncio is vulnerable to a flaw where a subdomain can remove the Host-Only scope from an existing parent-domain cookie. This occurs in versions prior to 3.14.4 . A user interacting with an untrusted subdomain could have host-onl...

CVE-2026-111749 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

EUVD-2026-104485

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...