CVE-2026-54279 AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
Attackers can bypass host-only cookie restrictions in aiohttp by exploiting persistence flaws, potentially leading to unintended cookie transmission across domains.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54279?
CVE-2026-54279 is a low-severity vulnerability in aio-libs aiohttp, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.
Weakness: CWE-665
Which versions are affected by CVE-2026-54279?
3 open source packages ship an affected version, including aiohttp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aiohttp PyPI | All versions | 3.14.1 |
aiohttp PyPI | All versions | 3.14.1 |
aiohttp PyPI | All versions | 3.14.1 |
Products include Aiohttp Aiohttp.
How do I fix CVE-2026-54279?
Upgrade aiohttp to 3.14.1 or later.
Is CVE-2026-54279 being exploited?
There is no known exploitation of CVE-2026-54279 in the wild and no public exploit code.
Other vulnerabilities in aio-libs aiohttp
- CVE-2024-52303 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
- CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
- CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp
- CVE-2023-49081 aiohttp's ClientSession is vulnerable to CRLF injection via version
- CVE-2026-22815 AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers
Sources
Also known as CLEANSTART-2026-KX50341, CLEANSTART-2026-SV63364, DEBIAN-CVE-2026-54279, ECHO-f4da-5cdf-f6c3, GHSA-2fqr-mr3j-6wp8, MINI-377r-hgw6-767c and 19 more.