High severity7.5GHSA Advisory· Published Jun 22, 2026· Updated Jun 26, 2026
CVE-2026-54279
CVE-2026-54279
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
aiohttpPyPI | < 3.14.1 | 3.14.1 |
Affected products
37- osv-coords35 versionspkg:apk/chainguard/authentik-2026.2pkg:apk/chainguard/airflow-core-2pkg:apk/chainguard/metaflow-service-fipspkg:apk/chainguard/py3.13-vllm-cuda-13.0pkg:apk/chainguard/tritonserver-backend-vllm-cuda-13.0pkg:apk/chainguard/py3.12-vllm-cuda-12.9pkg:apk/wolfi/mlflowpkg:apk/wolfi/open-webuipkg:apk/chainguard/airflow-3pkg:rpm/opensuse/python-aiohttp&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-aiohttp&distro=openSUSE%20Tumbleweedpkg:apk/chainguard/py3.13-scanner-test-libraries-aiohttppkg:apk/chainguard/request-1276pkg:apk/chainguard/text-generation-inferencepkg:apk/wolfi/airflow-3pkg:apk/chainguard/apache-beam-python-3.13-sdkpkg:pypi/aiohttppkg:apk/chainguard/authentik-2025.12pkg:apk/chainguard/awxpkg:apk/chainguard/py3.12-vllm-cuda-12.4pkg:apk/chainguard/py3.12-vllm-cuda-13.0pkg:apk/chainguard/tritonserver-backend-vllm-cuda-12.9pkg:apk/chainguard/apache-beam-python-3.11-sdkpkg:apk/chainguard/apache-beam-python-3.12-sdkpkg:apk/chainguard/authentik-fips-2025.12pkg:apk/chainguard/authentik-fips-2026.2pkg:apk/chainguard/dask-kubernetes-fipspkg:apk/chainguard/lmcache-cuda-12.8pkg:apk/chainguard/mlflowpkg:apk/chainguard/mlflow-fipspkg:apk/chainguard/open-webuipkg:apk/chainguard/py3.10-vllm-cuda-12.4pkg:apk/chainguard/py3.10-vllm-cuda-12.9pkg:apk/chainguard/py3.10-vllm-cuda-13.0pkg:apk/chainguard/py3.13-vllm-cuda-12.9
< 2026.2.4-r4+ 34 more
- (no CPE)range: < 2026.2.4-r4
- (no CPE)range: < 2.11.2-r6
- (no CPE)range: < 2.5.0-r5
- (no CPE)range: < 0.20.2-r1
- (no CPE)range: < 25.11-r9
- (no CPE)range: < 0.19.1-r0
- (no CPE)range: < 3.13.0-r1
- (no CPE)range: < 0.9.6-r5
- (no CPE)range: < 3.3.1-r0
- (no CPE)range: < 3.11.16-160000.6.1
- (no CPE)range: < 3.14.1-1.1
- (no CPE)range: < 0.0.1-r3
- (no CPE)range: < 0.29.0-r1
- (no CPE)range: < 3.3.7-r16
- (no CPE)range: < 3.3.1-r0
- (no CPE)range: < 2.74.0-r1
- (no CPE)range: < 3.14.1
- (no CPE)range: < 2025.12.6-r3
- (no CPE)range: < 24.6.1-r42
- (no CPE)range: < 0.18.1-r3
- (no CPE)range: < 0.20.2-r1
- (no CPE)range: < 25.9.0_git20260617-r2
- (no CPE)range: < 2.74.0-r3
- (no CPE)range: < 2.74.0-r1
- (no CPE)range: < 2025.12.6-r2
- (no CPE)range: < 2026.2.4-r3
- (no CPE)range: < 2026.3.0-r4
- (no CPE)range: < 0.5.3-r0
- (no CPE)range: < 3.13.0-r1
- (no CPE)range: < 3.13.0-r1
- (no CPE)range: < 0.9.6-r5
- (no CPE)range: < 0.18.1-r3
- (no CPE)range: < 0.19.1-r0
- (no CPE)range: < 0.20.2-r1
- (no CPE)range: < 0.19.1-r0
Patches
Vulnerability mechanics
References
3- github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2nvdPatch
- github.com/advisories/GHSA-2fqr-mr3j-6wp8ghsaADVISORY
- github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8nvdThird Party AdvisoryWEB
News mentions
1- Aiohttp: Nine CVEs Disclosed in a Single Day, Five Memory-Exhaustion DoS FlawsVypr Intelligence · Jun 15, 2026