CVE-2026-111749 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
A malicious subdomain can strip host-only protections from existing cookies in the aiohttp library, potentially weakening cookie isolation mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-111749?
CVE-2026-111749 is a low-severity vulnerability in aio-libs aiohttp, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.
Weakness: CWE-565
Which versions are affected by CVE-2026-111749?
2 open source packages ship an affected version, including aiohttp.
| Package | Affected | Fixed in |
|---|---|---|
aiohttp PyPI | All versions | 3.14.4 |
aiohttp PyPI | All versions | 3.14.4 |
How do I fix CVE-2026-111749?
Upgrade aiohttp to 3.14.4 or later.
Is CVE-2026-111749 being exploited?
There is no known exploitation of CVE-2026-111749 in the wild and no public exploit code.
Sources
Also known as AZL-110692, DEBIAN-CVE-2026-111749, ECHO-a1d2-3cce-f75b, GHSA-gx76-c99x-2c96, MINI-36q4-q7m6-h4cx, MINI-88j2-483r-j3r5 and 2 more.