Snyk agent scan: AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies (CVE-2026-111749)

CVE-2026-111749 describes a vulnerability in AIOHTTP where a subdomain can remove the Host-Only scope from an existing cookie associated with a parent domain. This behavior can strip the Host-Only flag, potentially weakening cookie security boundaries. The vulnerability affects versions of the product from 0.4.3 up to but not including 0.6.9. The CVSS 4.0 vector indicates network attack vector, low complexity, partial attack complexity, no privileges required, user interaction required, low impact on confidentiality and integrity, no impact on availability, and no scope or security requirement changes. No known exploits are reported in the wild. A patch is available for this issue.

The vulnerability could allow a subdomain to remove Host-Only protections from cookies, potentially exposing cookies to broader access than intended. However, since most affected use cases do not reflect these cookies back to browsers, the practical impact is limited. There is no indication of direct confidentiality, integrity, or availability compromise beyond the cookie scope weakening.

A patch is available for this vulnerability. Users should upgrade to a version later than or equal to 0.6.9 to remediate the issue. No additional mitigation steps are indicated or required according to the vendor advisory.