En bref
- CVE-2026-111063 est une vulnérabilité MOYENNE (CVSS 6.3) touchant aiohttp.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.23%, plus élevée que 14.2% des vulnérabilités.
- Correctif : mettre à jour vers 3.14.4 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| aiohttp PyPI | < 3.14.4
| 3.14.4
|
Description
Summary
The Secure attribute was not being enforced for the shared cookie.
Impact
It may be possible to send a shared cookie marked Secure through an unencrypted request.
NVD description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free