---
id: CVE-2026-111063
aliases:
  - GHSA-494j-54xm-rwp3
title: 'AIOHTTP: Secure attribute not enforced for shared cookie'
summary: 'AIOHTTP: Secure attribute not enforced for shared cookie'
severity: low
cvss: 6.3
cwe:
  - CWE-311
  - CWE-1004
vendor: aiohttp
product: aiohttp
ecosystem: pip
affected:
  - aiohttp <= 3.14.3
patched:
  - aiohttp 3.14.4
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T17:07:48Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-494j-54xm-rwp3'
references:
  - url: >-
      https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3
  - url: >-
      https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5
  - url: 'https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4'
  - url: 'https://github.com/advisories/GHSA-494j-54xm-rwp3'
tags:
  - ghsa
  - pip
  - cve.org
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
ingestedAt: '2026-10-19T17:33:42.441Z'
---

## Overview

### Summary

The Secure attribute was not being enforced for the shared cookie.

### Impact

It may be possible to send a shared cookie marked Secure through an unencrypted request.

## Affected packages

- `aiohttp <= 3.14.3`

## Remediation

Upgrade to a patched release:

- `aiohttp 3.14.4`