{"id":"CVE-2026-111063","aliases":["GHSA-494j-54xm-rwp3"],"title":"AIOHTTP: Secure attribute not enforced for shared cookie","summary":"AIOHTTP: Secure attribute not enforced for shared cookie","severity":"low","cvss":6.3,"cwe":["CWE-311","CWE-1004"],"vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp <= 3.14.3"],"patched":["aiohttp 3.14.4"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T17:07:48Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-494j-54xm-rwp3","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3"},{"url":"https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5"},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"},{"url":"https://github.com/advisories/GHSA-494j-54xm-rwp3"}],"tags":["ghsa","pip","cve.org"],"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","ingestedAt":"2026-10-19T17:33:42.441Z","slug":"CVE-2026-111063","body":"## Overview\n\n### Summary\n\nThe Secure attribute was not being enforced for the shared cookie.\n\n### Impact\n\nIt may be possible to send a shared cookie marked Secure through an unencrypted request.\n\n## Affected packages\n\n- `aiohttp <= 3.14.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.14.4`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}