CVE-2026-111749: AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

October 20, 2026

A subdomain can remove the Host-Only flag from an existing cookie to a parent domain.

References

github.com/advisories/GHSA-gx76-c99x-2c96
github.com/aio-libs/aiohttp/commit/6a07c171ef9f3be583e2907dcd1931372efca8d6
github.com/aio-libs/aiohttp/releases/tag/v3.14.4
github.com/aio-libs/aiohttp/security/advisories/GHSA-gx76-c99x-2c96
nvd.nist.gov/vuln/detail/CVE-2026-111749

Code Behaviors & Features

Detect and mitigate CVE-2026-111749 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →