{"id":"CVE-2026-111748","kind":"vulnerability","aliases":["CVE-2026-111748","GHSA-f9xw-jh8m-3mwq"],"related":[],"title":"AIOHTTP: Absolute-form request targets can spoof Request.scheme","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.","summary":"aiohttp accepts absolute-form request targets (a full URL on the request line) and takes the scheme from that URL, so a remote client can set Request.scheme to a value of its choosing. An application that makes security decisions from request.scheme, such as enforcing HTTPS, can be tricked into treating a plain connection as encrypted or the reverse.","severity":"medium","cvss":6.3,"epss":0.003650000086054206,"exploited":false,"exploited_at":null,"products":[{"name":"aiohttp","fixed":["3.14.4"],"affected":"<= 3.14.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["aiohttp","cwe-807","package","python","self-hosted","web-app"],"not_affected_if":["behind-proxy-rejecting-absolute-form","fixed-version-3.14.4-or-later","no-security-logic-on-request-scheme"],"how_to_check":"pip show aiohttp or check the lock file for aiohttp version 3.14.3 or lower.\nReview application code for uses of request.scheme in auth, redirect, cookie-secure or HTTPS-enforcement logic.","fix":"Upgrade aiohttp to 3.14.4.\nUntil upgraded, reject absolute-form request targets at a proxy or WAF, as the advisory suggests; legitimate clients only send that form to proxies.","status":"open","published_at":"2026-10-19T17:17:03+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:13:25+00:00","updated_at":"2026-10-23T21:57:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:13:25Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade aiohttp to 3.14.4.\nUntil upgraded, reject absolute-form request targets at a proxy or WAF, as the advisory suggests; legitimate clients only send that form to proxies.","summary":"aiohttp accepts absolute-form request targets (a full URL on the request line) and takes the scheme from that URL, so a remote client can set Request.scheme to a value of its choosing. An application that makes security decisions from request.scheme, such as enforcing HTTPS, can be tricked into treating a plain connection as encrypted or the reverse.","category":"package","who_cares":["python","aiohttp","self-hosted","web-app"],"confidence":0.8,"analyst_note":"","how_to_check":"pip show aiohttp or check the lock file for aiohttp version 3.14.3 or lower.\nReview application code for uses of request.scheme in auth, redirect, cookie-secure or HTTPS-enforcement logic.\nunknown for other checks.","needs_analyst":false,"not_affected_if":["no-security-logic-on-request-scheme","fixed-version-3.14.4-or-later","behind-proxy-rejecting-absolute-form"],"severity_if_unknown":"medium"},"cost_usd":0.000421,"input_tokens":2103,"output_tokens":421,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111748':12A,20A '-2026':11A,19A '-807':24B '3.14.4':105C,163C '3mwq':17A 'absolut':3A,36B,112C 'absolute-form':2A,35B,111C 'accept':34B 'aiohttp':1A,21A,22B,33B,92C 'app':32B 'applic':68B,133C 'asynchron':95C 'asyncio':100C 'attack':107C,121C 'attacker-control':120C 'caus':116C 'choos':66B 'client':57B 'client/server':97C 'connect':86B,131C,148C,154C 'consequ':141C 'control':122C 'cve':10A,18A 'cwe':23B 'data':127C 'decis':72B,139C 'encrypt':88B,150C,153C 'enforc':77B 'f9xw':15A 'fix':160C 'form':4A,37B,113C 'framework':98C 'full':41B 'ghsa':14A 'ghsa-f9xw-jh8m-3mwq':13A 'host':29B 'http':96C 'https':78B 'instead':128C 'issu':158C 'jh8m':16A 'line':46B 'make':70B 'packag':25B 'plain':85B 'prior':103C 'protocol':132C 'python':26B,102C 'remot':56B 'request':5A,38B,45B,114C,124C 'request-target':123C 'request.scheme':9A,60B,74B,117C,136C 'revers':91B 'scheme':50B,126C 'secur':71B,138C 'self':28B 'self-host':27B 'send':109C 'set':59B 'spoof':8A 'take':48B 'target':6A,39B,125C 'treat':83B,145C 'trick':81B,143C 'unencrypt':147C,156C 'url':42B,53B 'use':119C,135C 'valu':63B 'version':162C 'web':31B 'web-app':30B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-f9xw-jh8m-3mwq","url":"https://github.com/advisories/GHSA-f9xw-jh8m-3mwq","severity":"medium","published_at":"2026-10-20T20:01:40+00:00","modified_at":"2026-10-20T20:01:41+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-111748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111748","severity":null,"published_at":"2026-10-19T17:17:03+00:00","modified_at":"2026-10-19T20:55:02+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}