CVE-2026-111063Low· 6.3▾ SunlitAIOHTTP: Secure attribute not enforced for shared cookie
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Secure attribute was not being enforced for the shared cookie.
It may be possible to send a shared cookie marked Secure through an unencrypted request.
aiohttp <= 3.14.3Upgrade to a patched release:
aiohttp 3.14.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111064High· 8.2aiohttp server lacks an initial request/header timeout
CVE-2026-111065Medium· 6.9AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111066High· 8.2AIOHTTP: File descriptor exhaustion in multipart requests
CVE-2026-111748Medium· 6.3AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-111750Medium· 6.3AIOHTTP: Pure-Python parser request smuggling
CVE-2026-111749Low· 2.3AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies