[pkg-vuln] CVE-2026-54279 in aiohttp@3.13.5 #528

New Issue

kert · 2026-07-10T01:31:27Z

kert commented

2026-07-10 01:31:27 +00:00

Severity: LOW
Package: aiohttp @ 3.13.5
Fixed in: 3.14.1

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-54279

**Severity:** LOW **Package:** `aiohttp` @ `3.13.5` **Fixed in:** `3.14.1` AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1. **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-54279

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-07-10 01:31:27 +00:00

kert added the quality ci labels 2026-07-10 01:31:27 +00:00

kert commented

2026-07-10 17:18:59 +00:00

Not exploitable here. CVE-2026-54279 (host-only cookie flag lost on CookieJar.save()/load()): the stack never persists cookie jars. aiohttp enters this stack only as a transitive client dependency of the fsspec cloud-storage backends (s3fs / gcsfs / adlfs via aiobotocore — uv tree --invert --package aiohttp), talking to fixed, trusted storage endpoints. Nothing in the repo runs an aiohttp server or imports aiohttp directly.

Bumped anyway (defense in depth): aiohttp 3.13.5 → 3.14.1 in 65c31cf88f (uv.lock + pkg-manifest; pyproject floor raised for direct deps). Advisory link is in the issue body.

**Not exploitable here.** CVE-2026-54279 (host-only cookie flag lost on `CookieJar.save()`/`load()`): the stack never persists cookie jars. aiohttp enters this stack only as a transitive **client** dependency of the fsspec cloud-storage backends (s3fs / gcsfs / adlfs via aiobotocore — `uv tree --invert --package aiohttp`), talking to fixed, trusted storage endpoints. Nothing in the repo runs an aiohttp **server** or imports aiohttp directly. **Bumped anyway** (defense in depth): `aiohttp` 3.13.5 → 3.14.1 in https://git.fhirworx.io/homelab/stack/commit/65c31cf88fd8de552a006859159790de468403fb (uv.lock + pkg-manifest; pyproject floor raised for direct deps). Advisory link is in the issue body.

kert closed this issue

2026-07-10 17:18:59 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#528