PYSEC-2026-2112

vendorUSosv

view advisory published 2026-06-22Licence: CC-BY-4.0

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-54279US	high7.5	0.49% (42nd)	—	2026-06-22
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with…

references

External citations — patches, advisories, analysis.

https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2FIX
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan