En resumen
- CVE-2026-111063 es una vulnerabilidad MEDIO (CVSS 6.3) que afecta a aiohttp.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.23%, mayor que el 14.2% de las vulnerabilidades.
- Solución: actualizar a 3.14.4 o posterior.
| Package | Affected versions | Patched versions |
|---|
| aiohttp PyPI | < 3.14.4
| 3.14.4
|
Description
Summary
The Secure attribute was not being enforced for the shared cookie.
Impact
It may be possible to send a shared cookie marked Secure through an unencrypted request.
NVD description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free