kernel-debug-lab-for-virtual-box

How to set up a VirtualBox lab to debug Kernel Driver with Windbg We consider here that on Computer A windbg is already installed and on Computer B Visual Studio, the SDK and WDK are installed. 1. Open the Host network Manager to create or set up a new Virtual Box Host-Only Ethernet adapter 2...

SUSE CVE-2026-111749

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

EUVD-2026-104485

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies...

GHSA-GX76-C99X-2C96 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

Summary A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. Impact A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited...

Reliance on Cookies without Validation and Integrity Checking

Overview Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via deletecookies and updatecookies in aiohttp/cookiejar.py, where the host-only flag for a cookie is keyed only on domain, name instead of the full domain, path, name...

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

Summary A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. Impact A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited...

Linux Distros Unpatched Vulnerability : CVE-2026-111749

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be...

CVE-2026-111749

A flaw was found in aiohttp. When processing HTTP cookies, a response from an untrusted subdomain can remove the Host-Only attribute from an existing parent-domain cookie. This vulnerability allows an attacker controlling a subdomain to bypass domain isolation protections, potentially exposing...

DEBIAN-CVE-2026-111749

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

CVE-2026-111749

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

CVE-2026-111749 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

CVE-2026-111749 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

CVE-2026-111749 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

CVE-2026-111749

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

CVE-2026-111749

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

CVE-2026-111749

The AIOHTTP asynchronous HTTP client/server framework for Python and asyncio is vulnerable to a flaw where a subdomain can remove the Host-Only scope from an existing parent-domain cookie. This occurs in versions prior to 3.14.4 . A user interacting with an untrusted subdomain could have host-onl...

PT-2026-117519

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4 Description A subdomain can remove the Host-Only scope from an existing parent-domain cookie. This allows a user accessing an untrusted subdomain to have host-only protections stripped from cookies, though the...

CVE-2026-111749: Reliance on Cookies without Validation and Integrity Checking

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, althoug...

aio-libs Async HTTP client/server framework – Session mechanism-related vulnerabilities

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a session mechanism vulnerability. This vulnerability stems from the Host-Only scope, which allows the removal of cookies from the parent domain. Accessing untrusted subdomains may result in the Host-Only protection of...

WS-2026-0118

aiohttp 3.8.4 through 3.14.3: a cookie set by a subdomain with the same name can remove the Host-Only flag of an existing parent-domain cookie in the client CookieJar, widening its scope to other subdomains. GHSA-gx76-c99x-2c96...