CVE-2026-111748Medium· 6.3▾ SunlitAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of th…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.
aiohttp < 3.14.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111065Medium· 6.9AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111066High· 8.2AIOHTTP: File descriptor exhaustion in multipart requests
CVE-2026-111750Medium· 6.3AIOHTTP: Pure-Python parser request smuggling
CVE-2026-111749Low· 2.3AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
CVE-2026-111064High· 8.2aiohttp server lacks an initial request/header timeout
CVE-2026-111063Low· 6.3AIOHTTP: Secure attribute not enforced for shared cookie