Live › vulnerability › CVE-2026-111063
Go to dashboardaiohttp's cookie handling did not enforce the Secure attribute on shared cookies, so a cookie marked Secure could be sent over an unencrypted HTTP request. An attacker on the network path could capture that cookie, such as a session token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| aiohttp | pypi | <= 3.14.3 | 3.14.4 |
pip show aiohttp to read the installed version; unknown whether any other file or setting indicates exposure.
Upgrade aiohttp to 3.14.4 or later (pip install -U aiohttp).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-111063")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.