HIGH7.5

PYSEC-2026-2112

Quick fix

PYSEC-2026-2112 — aiohttp: upgrade to the fixed version with the command below.

pip install --upgrade 'aiohttp>=3.14.1'

Details

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/aiohttp

Introduced in: 0Fixed in: 3.14.1

Fixpip install --upgrade 'aiohttp>=3.14.1'

References

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8[ADVISORY]
https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2[FIX]