CVE-2026-54279: AIOHTTP Information Disclosure Flaw

CVE-2026-54279 Overview

CVE-2026-54279 is a low-severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for asyncio and Python. The flaw exists in the CookieJar persistence logic in versions prior to 3.14.1. When host-only cookies are serialized using CookieJar.save() and later deserialized using CookieJar.load(), the host-only attribute is not preserved. After restoration, these cookies behave as domain cookies and can be sent to subdomains of the original host.

The issue is categorized under [CWE-665: Improper Initialization]. Maintainers fixed the defect in aiohttp 3.14.1.

Critical Impact
Restored cookies lose their host-only restriction, expanding the set of hosts that receive the cookie and potentially exposing session data to unintended subdomains.

Affected Products

aiohttp versions prior to 3.14.1
Python applications using CookieJar.save() and CookieJar.load() for cookie persistence
HTTP clients built on aiohttp that share serialized cookie state across sessions

Discovery Timeline

2026-06-22 - CVE-2026-54279 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-54279

Vulnerability Analysis

The aiohttp.CookieJar class manages cookies for HTTP client sessions. When a server sets a cookie without an explicit Domain attribute, the cookie becomes host-only per [RFC 6265]. Host-only cookies must be sent only to the exact host that issued them, not to subdomains.

The vulnerability stems from the serialization path in CookieJar.save(). The host-only flag, tracked internally by the jar, is not persisted alongside the cookie data. When CookieJar.load() reconstructs the jar from the saved state, every restored cookie is treated as if it had an explicit Domain attribute. The host-only restriction is silently dropped.

Applications that persist cookies across runs, share jars between workers, or migrate sessions between processes are affected. The behavior change occurs only after a save/load cycle, which makes the regression hard to spot through routine testing.

Root Cause

The root cause is improper initialization of cookie metadata during deserialization. The _host_only_cookies set inside CookieJar is not included in the saved pickle payload, so the loaded jar starts with an empty host-only set even when the source jar contained host-only entries.

Attack Vector

Exploitation requires user interaction and a specific application workflow. An attacker who controls a subdomain of a host that issued a host-only cookie can receive that cookie after a victim application loads a previously saved jar. The attack vector is network-based but limited to scenarios where cookies are persisted and later restored. No code execution, integrity impact, or availability impact results from the flaw. For technical details, see the GitHub Security Advisory GHSA-2fqr-mr3j-6wp8 and the upstream commit.

Detection Methods for CVE-2026-54279

Indicators of Compromise

Outbound HTTP requests from aiohttp clients sending cookies to subdomains that should only receive cookies on the exact parent host.
Presence of persisted CookieJar files generated by aiohttp versions earlier than 3.14.1.
Application logs showing cookie reuse across hostnames after a session restore.

Detection Strategies

Inventory Python dependencies and flag any project pinning aiohttp below 3.14.1.
Audit code paths that call CookieJar.save() and CookieJar.load() to identify systems that persist client cookies.
Compare cookie scope before save and after load in integration tests to detect host-only attribute loss.

Monitoring Recommendations

Monitor egress traffic from services using aiohttp for unexpected cookie headers sent to subdomains.
Track aiohttp package versions across build pipelines and container images using software composition analysis.
Alert on creation or modification of persisted cookie jar files in production environments.

How to Mitigate CVE-2026-54279

Immediate Actions Required

Upgrade aiohttp to version 3.14.1 or later across all environments and container images.
Invalidate any cookie jars saved by earlier versions and force a fresh login or token issuance.
Review applications that share persisted CookieJar state between services and confirm host scoping after upgrade.

Patch Information

The defect is fixed in aiohttp 3.14.1. The fix persists the host-only set during CookieJar.save() and restores it during CookieJar.load(). See the aiohttp commit a329a7a for the change.

Workarounds

Avoid using CookieJar.save() and CookieJar.load() until the upgrade is complete. Rebuild cookie state from authentication flows instead.
For required persistence, manually re-mark host-only cookies after load() by clearing the cookie Domain attribute for hosts that originally issued host-only cookies.
Restrict subdomain trust boundaries so that subdomains do not host untrusted content if cookies might leak to them.

bash

# Upgrade aiohttp to the patched release
pip install --upgrade "aiohttp>=3.14.1"

# Verify the installed version
python -c "import aiohttp; print(aiohttp.__version__)"