VDB

CVE-2026-111063

CVE-2026-111063 PUBLISHED CVSS 6.3 MEDIUM

AIOHTTP: Secure attribute not enforced for shared cookie

Reported by github_m · Published October 19, 2026

aiohttp is fixed in 3.14.4 (PyPI)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
aiohttpPyPI3.14.4
kserve-lgbserver-fipsChainguard0.21.0-r2
kserveWolfi0.21.0-r9
dask-kubernetesChainguard2026.3.0-r18
datahub-ingestionChainguard1.7.0.1-r3
elastic-connectors-fips-9.5Chainguard9.5.4-r2
metaflow-serviceChainguard2.6.1-r5
litellm-fipsChainguard1.106.1-r1
elastic-connectors-fips-8.19Chainguard8.19.23-r1
dask-kubernetes-fipsChainguard2026.3.0-r15
nemo-rl-cuda-13.0Chainguard0.7.0-r8
datahub-ingestion-fipsChainguard1.7.0.1-r4

13 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0
6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

VendorProductVersions
aio-libsaiohttp< 3.14.4
chainguardkserve-lgbserver-fips0
wolfikserve0
chainguarddask-kubernetes0
chainguarddatahub-ingestion0
chainguardelastic-connectors-fips-9.50
chainguardmetaflow-service0
chainguardlitellm-fips0
chainguardelastic-connectors-fips-8.190
chainguarddask-kubernetes-fips0
chainguardnemo-rl-cuda-13.00
chainguarddatahub-ingestion-fips0
PyPIaiohttp0
chainguardkserve-xgbserver-fips0
chainguardelastic-connectors-9.50
wolfiopen-webui0
chainguardkserve0
chainguardcommercial-gitlab-cng-ee-19.10
chainguardpy3.13-scanner-test-libraries-aiohttp0
wolfidask-kubernetes0

…and 14 more

Timeline

  • Oct 19, 2026 CVE Published
  • Oct 19, 2026 Coalition ESS Score
  • Oct 20, 2026 EPSS Score (4 in total, the first dated here)
  • Oct 22, 2026 CVE Updated
  • Oct 30, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-111063
vulnetix vdb fixes CVE-2026-111063

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-111063/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›