CVE-2026-111749

The record

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.

Affected packages

Related vulnerabilities

• CVE-2026-75757 Reliance on Cookies without Validation and Integrity Checking vulnerability in… CWE-565
• CVE-2026-8337 Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site… CWE-565
• CVE-2026-0257 Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo… CWE-565
• CVE-2026-39963 Serendipity is a PHP-powered weblog engine. CWE-565
• CVE-2026-39324 Rack::Session is a session management implementation for Rack. CWE-565
• CVE-2026-5130 The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated… CWE-565
• CVE-2014-125112 Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code… CWE-565
• CVE-2022-50926 WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability… CWE-565