This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-54279 →

DEBIAN-CVE-2026-54279

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save(...

Original description

The description as published by the source.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 python-aiohttp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 python-aiohttp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 python-aiohttp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.1-1"}]}]

References

advisory security-tracker.debian.org