What is GHSA-gx76-c99x-2c96?

GHSA-gx76-c99x-2c96 is a security advisory published by GitHub Security Advisories with Low severity. AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

Which CVE IDs does GHSA-gx76-c99x-2c96 cover?

GHSA-gx76-c99x-2c96 covers the following CVE IDs: CVE-2026-111749. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-gx76-c99x-2c96?

GHSA-gx76-c99x-2c96 affects 1 product, including: pip/aiohttp:\u003c= 3.14.3.

GHSA-gx76-c99x-2c96Low

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

Vendor

GitHub Security Advisories

Published

October 20, 2026

Last Modified

October 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-111749 →

📋 Description

Summary

A subdomain can remove the Host-Only flag from an existing cookie to a parent domain.

Impact

A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.

🎯 Affected products1

pip/aiohttp:<= 3.14.3

🔗 References (5)

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gx76-c99x-2c96
https://nvd.nist.gov/vuln/detail/CVE-2026-111749
https://github.com/aio-libs/aiohttp/commit/6a07c171ef9f3be583e2907dcd1931372efca8d6
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
https://github.com/advisories/GHSA-gx76-c99x-2c96