Snyk agent scan: AIOHTTP: Absolute-form request targets can spoof Request.scheme (CVE-2026-111748)

CVE-2026-111748 describes a vulnerability in AIOHTTP where an attacker can send an absolute-form HTTP request to spoof the Request.scheme attribute. This can cause user code that depends on this attribute for security logic to be bypassed, potentially leading to incorrect assumptions about the security of the connection (e.g., believing it is encrypted when it is not). The vulnerability affects versions >=0.4.3 and <0.6.9. A workaround involves rejecting absolute-form requests via a WAF rule. A patch is available, though no specific patch links are provided.

If an application relies on the Request.scheme attribute for security decisions, this vulnerability could allow an attacker to circumvent such logic, potentially leading to security bypass scenarios such as misclassifying an unencrypted connection as encrypted or vice versa. This could impact the confidentiality or integrity of data handled by the application.

A patch is available for this vulnerability and should be applied to affected versions. As an interim mitigation, implement a WAF rule to reject absolute-form HTTP requests, since legitimate requests typically do not use this form except for proxies. Review application logic that depends on Request.scheme for security decisions.