HIGH 7.5 PyPI
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
GHSA-2fqr-mr3j-6wp8 · CVE-2026-54279 · PYSEC-2026-2112
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Summary
Host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status.
Impact
Host-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed.
Patch: https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2
References
- WEB https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-54279
- WEB https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2
- PACKAGE https://github.com/aio-libs/aiohttp
- WEB https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2026-2112.yaml
Ready to move
Start Securing
Free, no credit card | First findings in minutes