Kurz gesagt
- CVE-2026-111063 ist eine Schwachstelle (MITTEL (CVSS 6.3)) in aiohttp.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.23%, höher als bei 14.2% aller Schwachstellen.
- Abhilfe: auf 3.14.4 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| aiohttp PyPI | < 3.14.4
| 3.14.4
|
Description
Summary
The Secure attribute was not being enforced for the shared cookie.
Impact
It may be possible to send a shared cookie marked Secure through an unencrypted request.
NVD description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free