CVE-2026-111749
Fixed in a distro release EPSS <1%CVSS 2.3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.
Products: aio-libs aiohttp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | aiohttp | 3.14.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | commercial-gitlab-toolbox-ee-19.1 | no fix |
| Chainguard | commercial-gitlab-toolbox-ee-19.1 | 19.1.9-r0 |
| Chainguard | commercial-gitlab-toolbox-ee-fips-19.1 | 19.1.9-r0 |
| Chainguard | commercial-gitlab-toolbox-ee-fips-19.1 | no fix |
| Chainguard | kserve-storage-controller | 0.21.0-r9 |
| Chainguard | litellm-fips | 1.106.1-r1 |
| Chainguard | lmcache-cuda-12.8 | no fix |
| Chainguard | metaflow-service | no fix |
| Chainguard | metaflow-service | 2.6.1-r5 |
| Chainguard | nemo-skills | no fix |
| Chainguard | py3.13-scanner-test-libraries-aiohttp | 0.0.1-r6 |
| Debian 12 | python-aiohttp | no fix |
| Debian 13 | python-aiohttp | no fix |
| Debian 14 | python-aiohttp | no fix |
| Ubuntu 26.10 | python-aiohttp | no fix |
| Ubuntu Pro 16.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 18.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 20.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 22.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 24.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 26.04 LTS | python-aiohttp | no fix |
| Wolfi | kserve-storage-controller | 0.21.0-r9 |