CVE-2026-54279
2 advisories.
PyPI/aiohttp CVE-2026-54279: low, EPSS 0.49%
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
Action: Upgrade aiohttp to 3.14.1 or later.
pip install aiohttp==3.14.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.14.1 | - |
Fixed versions
| 3.14.1 |
Sources
- osv: GHSA-2fqr-mr3j-6wp8
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8
- https://github.com/aio-libs/aiohttp
CVE-2026-54279 · published · modified · JSON
PyPI/aiohttp CVE-2026-54279: high 7.5, EPSS 0.49%
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lo
Action: Upgrade aiohttp to 3.14.1 or later.
pip install aiohttp==3.14.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.14.1 | - |
Fixed versions
| 3.14.1 |
Sources
- osv: PYSEC-2026-2112
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8
- https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2
CVE-2026-54279 · published · modified · JSON