CVE-2026-54279: AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
Summary
Host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status.
Impact
Host-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1Patch a329a7aacad5284f087af36103aff778746da0f2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54279?
The severity of CVE-2026-54279 is rated as 23.
How does CVE-2026-54279 impact web security?
CVE-2026-54279 allows host-only cookies to be sent to subdomains, potentially compromising user privacy.
What software is affected by CVE-2026-54279?
CVE-2026-54279 affects the pip/aiohttp software.
How can I fix CVE-2026-54279?
To fix CVE-2026-54279, ensure the correct handling of host-only cookies when using CookieJar.save() and CookieJar.load().
When was CVE-2026-54279 published?
CVE-2026-54279 was published on June 15, 2026.