CVE-2026-54279: AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-22 · updated 2026-10-25
Weakness: CWE-665

Description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

Affected products

aio-libs aiohttp: before 3.14.1 — fixed in 3.14.1
Pypi Aiohttp: before 3.14.1; 0.1, 0.10.0, 0.10.1, 0.10.2, 0.11.0, 0.12.0 (+301) — fixed in 3.14.1

How to fix

Upgrade to a fixed version: aio-libs aiohttp 3.14.1; Pypi Aiohttp 3.14.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-54279 or the next vulnerability affects your stack