PT-2026-49593

CVE-2026-54279

Published

2026-06-15

Updated

2026-11-03

Description by

CVSS 2.0

7.8

High

MetricsAV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.1

Description Host-only cookies saved using the CookieJar.save() function and subsequently restored via the CookieJar.load() function lose their host-only status. This can result in cookies loaded from disk being sent to subdomains that should have been disallowed.

Recommendations Update to version 3.14.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Denyspakizh-Tob

Vendors

Affected products

Weakness enumeration

CWE-665: Improper Initialization

Related identifiers