CVE-2026-111749 aio-libs CVE debrief

Who should care

Defenders and developers using aiohttp for asynchronous HTTP operations should assess exposure and prioritize verification and upgrades. They should review applications for potential impacts of Host-Only scope removal and verify and upgrade to aiohttp version 3.14.4 or later. Security teams and operators should also be aware of the vulnerability and its potential impact on their environments.

Why it matters

Defenders should care about CVE-2026-111749 as it affects aiohttp, allowing a subdomain to remove Host-Only scope from existing cookies. Although impact is limited when applications do not reflect those cookies to a browser, verification and upgrades to version 3.14.4 or later are necessary.

• Potential stripping of host-only protections from cookies
• Limited impact when applications do not reflect cookies to a browser
• Verification of aiohttp version and exposure in environments
• Prioritization of upgrades to version 3.14.4 or later

Technical summary

A vulnerability in aiohttp allows a subdomain to remove Host-Only scope from existing parent-domain cookies. This issue is fixed in version 3.14.4. The vulnerability affects the aiohttp library, and defenders should prioritize verifying and upgrading to aiohttp version 3.14.4 or later, and assess exposure in their environments, especially for applications using aiohttp for asynchronous HTTP operations. The impact is limited when applications do not reflect those cookies to a browser, but verification and upgrades are necessary.

Defensive priority

Defenders should prioritize verifying and upgrading to aiohttp version 3.14.4 or later, and assess exposure in their environments, especially for applications using aiohttp for asynchronous HTTP operations.

Recommended defensive actions

• Verify and upgrade to aiohttp version 3.14.4 or later
• Assess exposure in environments using aiohttp for asynchronous HTTP operations
• Review applications for potential impacts of Host-Only scope removal
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in aiohttp, where a subdomain can remove Host-Only scope from existing parent-domain cookies. The issue is fixed in version 3.14.4. Evidence from the CVE Program record and source item confirms the vulnerability's existence and provides details on the affected product and version. Defenders should verify and upgrade to aiohttp version 3.14.4 or later and assess exposure in their environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.