{"id":"CVE-2026-111063","kind":"vulnerability","aliases":["CVE-2026-111063","GHSA-494j-54xm-rwp3"],"related":[],"title":"AIOHTTP: Secure attribute not enforced for shared cookie","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.","summary":"aiohttp's cookie handling did not enforce the Secure attribute on shared cookies, so a cookie marked Secure could be sent over an unencrypted HTTP request. An attacker on the network path could capture that cookie, such as a session token.","severity":"medium","cvss":6.3,"epss":0.002199999988079071,"exploited":false,"exploited_at":null,"products":[{"name":"aiohttp","fixed":["3.14.4"],"affected":"<= 3.14.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["aiohttp","cwe-1004","cwe-311","package","python","web-client"],"not_affected_if":["aiohttp-3.14.4-or-later","no-secure-cookies-over-http"],"how_to_check":"pip show aiohttp to read the installed version; unknown whether any other file or setting indicates exposure.","fix":"Upgrade aiohttp to 3.14.4 or later (pip install -U aiohttp).","status":"open","published_at":"2026-10-19T17:07:47+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:15:34+00:00","updated_at":"2026-10-23T21:57:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:15:34Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade aiohttp to 3.14.4 or later (pip install -U aiohttp).","summary":"aiohttp's cookie handling did not enforce the Secure attribute on shared cookies, so a cookie marked Secure could be sent over an unencrypted HTTP request. An attacker on the network path could capture that cookie, such as a session token.","category":"package","who_cares":["python","aiohttp","web-client"],"confidence":0.7,"analyst_note":"","how_to_check":"pip show aiohttp to read the installed version; unknown whether any other file or setting indicates exposure.","needs_analyst":false,"not_affected_if":["aiohttp-3.14.4-or-later","no-secure-cookies-over-http"],"severity_if_unknown":"low"},"cost_usd":0.000336,"input_tokens":2017,"output_tokens":269,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-1004':23B '-111063':11A,19A '-2026':10A,18A '-311':25B '3.14.4':85C,119C '494j':14A '54xm':15A 'aiohttp':1A,20A,21B,31B,72C 'asynchron':75C 'asyncio':80C 'attack':58B,97C 'attribut':3A,40B,88C 'captur':64B 'caus':100C 'client':30B 'client/server':77C 'consequ':99C 'cooki':8A,33B,43B,46B,66B,92C,103C 'could':49B,63B 'cve':9A,17A 'cwe':22B,24B 'enforc':5A,37B,95C 'fix':116C 'framework':78C 'ghsa':13A 'ghsa-494j-54xm-rwp3':12A 'handl':34B 'http':55B,76C 'issu':114C 'mark':47B,104C 'network':61B 'packag':26B 'path':62B 'prior':83C 'python':27B,82C 'request':56B,112C 'rwp3':16A 'secur':2A,39B,48B,87C,105C 'sent':51B,108C 'session':70B 'share':7A,42B,91C,102C 'token':71B 'unencrypt':54B,111C 'version':118C 'web':29B 'web-client':28B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:07:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-494j-54xm-rwp3","url":"https://github.com/advisories/GHSA-494j-54xm-rwp3","severity":"low","published_at":"2026-10-19T17:07:47+00:00","modified_at":"2026-10-19T17:07:48+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-111063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111063","severity":null,"published_at":"2026-10-19T17:17:03+00:00","modified_at":"2026-10-22T21:17:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}