Live › vulnerability › CVE-2026-111748
Go to dashboardaiohttp accepts absolute-form request targets (a full URL on the request line) and takes the scheme from that URL, so a remote client can set Request.scheme to a value of its choosing. An application that makes security decisions from request.scheme, such as enforcing HTTPS, can be tricked into treating a plain connection as encrypted or the reverse.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| aiohttp | pypi | <= 3.14.3 | 3.14.4 |
pip show aiohttp or check the lock file for aiohttp version 3.14.3 or lower3.14.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-111748")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.