---
id: "CVE-2026-111748"
kind: "vulnerability"
aliases: ["CVE-2026-111748", "GHSA-f9xw-jh8m-3mwq"]
title: "AIOHTTP: Absolute-form request targets can spoof Request.scheme"
severity: "medium"
cvss: 6.3
epss: 0.003650000086054206
exploited: false
status: "open"
category: "package"
products: [{"name": "aiohttp", "fixed": ["3.14.4"], "affected": "<= 3.14.3", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["aiohttp", "cwe-807", "package", "python", "self-hosted", "web-app"]
not_affected_if: ["behind-proxy-rejecting-absolute-form", "fixed-version-3.14.4-or-later", "no-security-logic-on-request-scheme"]
published_at: "2026-10-19T17:17:03+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:18+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-f9xw-jh8m-3mwq", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111748", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# AIOHTTP: Absolute-form request targets can spoof Request.scheme

aiohttp accepts absolute-form request targets (a full URL on the request line) and takes the scheme from that URL, so a remote client can set Request.scheme to a value of its choosing. An application that makes security decisions from request.scheme, such as enforcing HTTPS, can be tricked into treating a plain connection as encrypted or the reverse.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:aiohttp affected <= 3.14.3 fixed 3.14.4

## How to check

pip show aiohttp or check the lock file for aiohttp version 3.14.3 or lower.
Review application code for uses of request.scheme in auth, redirect, cookie-secure or HTTPS-enforcement logic.

## Fix

Upgrade aiohttp to 3.14.4.
Until upgraded, reject absolute-form request targets at a proxy or WAF, as the advisory suggests; legitimate clients only send that form to proxies.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-f9xw-jh8m-3mwq
- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111748

## From the sources

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_