Low severityNVD Advisory· Published Oct 19, 2026

CVE-2026-111749

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Aio Libs/Aiohttpllm-fuzzy
Range: <3.14.4

Patches

Vulnerability mechanics

References

github.com/aio-libs/aiohttp/commit/6a07c171ef9f3be583e2907dcd1931372efca8d6nvd
github.com/aio-libs/aiohttp/releases/tag/v3.14.4nvd
github.com/aio-libs/aiohttp/security/advisories/GHSA-gx76-c99x-2c96nvd

News mentions

No linked articles in our index yet.

cvss	0.065
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000