Vulnerability GHSA-2fqr-mr3j-6wp8
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 months ago
June 15, 2026 at 08:08 PM UTC
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
0.1 - 3.14.0
0.1 - 3.14.0
Summary
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
Details
Summary
Host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status.
Impact
Host-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed.
Patch: https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
14 days ago
AIOHTTP: Pure-Python parser request smuggling
0.1 - 3.14.3 GHSA-pqxq-w44r-73xw
0.1 - 3.14.3 GHSA-pqxq-w44r-73xw
High Risk
14 days ago
AIOHTTP: File descriptor exhaustion in multipart requests
2.0.0 - 3.14.3 GHSA-9xw5-w5jj-pvcg
2.0.0 - 3.14.3 GHSA-9xw5-w5jj-pvcg
High Risk
15 days ago
aiohttp server lacks an initial request/header timeout
0.1 - 3.14.3 GHSA-5wr8-gcqf-gqf3
0.1 - 3.14.3 GHSA-5wr8-gcqf-gqf3
Medium Risk
15 days ago
AIOHTTP: Secure attribute not enforced for shared cookie
0.1 - 3.14.3 GHSA-494j-54xm-rwp3
0.1 - 3.14.3 GHSA-494j-54xm-rwp3
High Risk
15 days ago
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
0.1 - 3.14.3 GHSA-2g87-pp6c-29x5
0.1 - 3.14.3 GHSA-2g87-pp6c-29x5
Impacted packages
Timeline
Published
4 months ago
June 15, 2026 at 08:08 PM UTC
Fixed (3.14.1)
4 months ago
June 07, 2026 at 09:08 PM UTC
Last Modified
17 hours ago
November 03, 2026 at 04:45 PM UTC