Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aiohttp | pip | <= 3.14.0 | 3.14.1 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the cookie persistence mechanism of aiohttp.cookiejar.CookieJar. When cookies are saved using CookieJar.save() and later reloaded using CookieJar.load(), any 'host-only' cookies lose their restricted status and are incorrectly promoted to 'domain cookies'. This allows them to be sent to subdomains, which could lead to session information leakage.
The root cause is twofold:
save method failed to record the 'host-only' status of cookies during serialization to a file.load method, consequently, had no information to determine if a cookie should be host-only and treated it as a standard domain cookie.The patch rectifies this by modifying save to explicitly store a "host_only": True attribute for relevant cookies. The load method was also updated to recognize this new attribute and correctly restore the host-only restriction by clearing the domain on the cookie morsel before processing it, thereby ensuring the cookie's scope is not improperly widened.
CookieJar.saveaiohttp/cookiejar.py
CookieJar.loadaiohttp/cookiejar.py