VDB
CVE-2026-111748
CVE-2026-111748
PUBLISHED
CVSS 6.3 MEDIUM
Reported by GitHub_M · Published October 19, 2026
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.
Risk Scores
CVSS 4.0
6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| aio-libs | aiohttp | < 3.14.4 |
| chainguard | commercial-gitlab-cng-ee-fips-19.1 | 0 |
| chainguard | kserve | 0 |
| chainguard | py3.13-scanner-test-libraries-aiohttp | 0 |
| aio-libs | aiohttp | 0 |
| chainguard | litellm-fips | 0 |
| chainguard | metaflow-service | 0 |
| wolfi | kserve | 0 |
| chainguard | commercial-gitlab-cng-ee-19.1 | 0 |
| PyPI | aiohttp | 0 |
Timeline
- Oct 19, 2026 Coalition ESS Score
- Oct 19, 2026 CVE Published
- Oct 19, 2026 CVE Updated
- Oct 20, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-f9xw-jh8m-3mwq x_refsource_CONFIRM
- https://github.com/aio-libs/aiohttp/commit/6d4e7b01f9b951aa084a75d7356e907d4ee80411 x_refsource_MISC
- https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-111748 advisory
- https://github.com/advisories/GHSA-f9xw-jh8m-3mwq advisory