CVE-2026-111748: CWE-807: Reliance on Untrusted Inputs in a Security Decision in aio-libs aiohttp
Description
CVE-2026-111748 is a vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Prior to version 3.14.4, the Request.scheme attribute can be influenced by attacker-controlled request-target scheme data when an absolute-form request is sent. This can cause applications relying on Request.scheme for security decisions to misinterpret the connection as encrypted or unencrypted incorrectly. The issue is fixed in aiohttp version 3.14.4.
CVSS v4.0
Score 6.3medium
Affected software
aio-libs
aiohttp
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from aiohttp's handling of absolute-form HTTP requests where the Request.scheme attribute is set based on the request-target scheme data controlled by an attacker rather than the actual connection protocol. This reliance on untrusted input for security decisions (CWE-807) can lead to incorrect assumptions about the security state of the connection, potentially causing applications to treat unencrypted connections as encrypted or vice versa. The flaw affects aiohttp versions prior to 3.14.4 and has been addressed in version 3.14.4.
Potential Impact
Applications using aiohttp versions before 3.14.4 that rely on Request.scheme for security decisions may be tricked into misclassifying the security state of a connection. This could lead to improper handling of sensitive data or bypass of security controls that depend on the connection being encrypted. The CVSS 4.0 score is 6.3 (medium severity), indicating a moderate impact with network attack vector, low complexity, and partial attack and vulnerability impacts.
Mitigation Recommendations
Upgrade aiohttp to version 3.14.4 or later, where this vulnerability is fixed. No other mitigation is specified or required as the official fix addresses the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-16T17:52:09.080Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad651102cdf04f65676be64
Added to database: 10/19/2026, 17:19:12 UTC
Last enriched: 10/19/2026, 17:33:38 UTC
Last updated: 10/19/2026, 17:34:11 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.