Medium severity · published Oct 19, 2026
CVE-2026-111748
AIOHTTP: Absolute-form request targets can spoof Request.scheme
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
aiohttp · aio-libs
< 3.14.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111748
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111748
github.com
https://github.com/aio-libs/aiohttp/commit/6d4e7b01f9b951aa084a75d7356e907d4ee80411
github.com
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4
github.com
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-f9xw-jh8m-3mwq
More from aiohttp
9.1
CVE-2026-34520
AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass
8.2
CVE-2026-111066
AIOHTTP: File descriptor exhaustion in multipart requests
8.2
CVE-2026-111064
aiohttp server lacks an initial request/header timeout
7.5
CVE-2026-54273
AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
7.5
CVE-2026-54280
AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect