TI-2026-76531 Aliases CVE-2026-111749 GHSA-gx76-c99x-2c96

Subdomain cookies can strip Host-Only scope in AIOHTTP

LOW 20CWE-565Published 2026-10-19 · Updated 2026-10-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 13 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

AIOHTTP versions before 3.14.4 are affected. A subdomain can remove the Host-Only scope from an existing parent-domain cookie because the framework relies on cookies without validation and integrity checking (CWE-565). A user who visits an untrusted subdomain can have host-only protections stripped from cookies, although the impact is limited when applications do not reflect those cookies to a browser.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00384 32nd percentileScored 2026-11-07

Fix Partial aiohttp (aio-libs): 3.14.4aiohttp (PyPI): 3.14.4Red Hat: 13 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
aio-libs	aiohttp	before 3.14.4	3.14.4	Patch available	CNA
—	aiohttp (PyPI)	before 3.14.4	3.14.4	Patch available	GHSA-gx76-c99x-2c96

aiohttp Vendoraio-libs Affected before 3.14.4 Fixed in 3.14.4 Patch available CNA
aiohttp (PyPI) Vendor— Affected before 3.14.4 Fixed in 3.14.4 Patch available GHSA-gx76-c99x-2c96

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:aiohttp:aiohttp::::::::	—	—	Aiohttp

cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* Versions — — ·Aiohttp

Remediation

Upgrade the aiohttp package on PyPI to version 3.14.4, which fixes the issue. The sources list no fixed version for Exploit Intelligence and Red Hat Update Infrastructure 4 for Cloud Providers, and for 11 other affected products, including Lightspeed Core and Red Hat OpenShift AI (RHOAI).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA aiohttp (aio-libs) Fixed in 3.14.4
Fix · GHSA-gx76-c99x-2c96 aiohttp (PyPI) Fixed in 3.14.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Exploit Intelligence	Affected	No fix planned: Out of support scope
Lightspeed Core	Affected	No fix yet: Fix deferred
Migration Toolkit for Applications 8	Affected	No fix yet: Fix deferred
OpenShift Lightspeed	Affected	No fix yet: Fix deferred
Red Hat AI Inference Server	Affected	No fix yet: Fix deferred
Red Hat Ansible Automation Platform 2	Affected	No fix yet: Fix deferred
Red Hat Ansible Automation Platform Ansible Core 2	Affected	No fix yet: Fix deferred
Red Hat Discovery 2	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat Lightspeed Services for OCP	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat Satellite 6	Affected	No fix yet: Fix deferred
Red Hat Update Infrastructure 4 for Cloud Providers	Affected	No fix planned: Out of support scope

Timeline

2026-10-19 Threatist record created from CVE-2026-111749
2026-10-20 Affected versions changed · Red Hat
2026-10-20 CVSS score added · Red Hat
2026-10-21 Alias added: GHSA-gx76-c99x-2c96
2026-10-21 Fix available: PyPI/[email protected] · GHSA-gx76-c99x-2c96
2026-10-21 CVSS score added · GHSA-gx76-c99x-2c96
2026-10-21 Weakness changed · GHSA-gx76-c99x-2c96
2026-10-21 5 new references · GHSA-gx76-c99x-2c96
2026-10-23 CISA SSVC decision points changed

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-111749

Other 4

TI-2025-38826 aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server CVSS 4.0HIGH 8.2
TI-2024-15436 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal CVSS 3.1HIGH 7.5
TI-2023-25769 Request smuggling in aiohttp CVSS 3.1HIGH 7.5
TI-2023-18906 aiohttp vulnerable to HTTP request smuggling CVSS 3.1HIGH 7.5
TI-2023-26746 aiohttp's ClientSession is vulnerable to CRLF injection via version CVSS 3.1HIGH 7.2
TI-2026-66145 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction CVSS 3.1MEDIUM 5.3

See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences