prowler

A vulnerability in AIOHTTP allows the Secure attribute of a shared cookie to not be enforced, potentially permitting the cookie to be sent over unencrypted requests. This issue affects versions from 3.13.0 up to but not including 5.45.0. A fix is available in version 5.45.0.

AIOHTTP: Secure attribute not enforced for shared cookie (CVE-2026-111063)

lexicon

A vulnerability in AIOHTTP allows the Secure attribute of a shared cookie to not be enforced, potentially causing the cookie to be sent over unencrypted requests. This flaw affects versions from 3.25.2_3 up to but not including 3.25.2_5 and has a medium severity rating. A fix is available in version 3.25.2_5.

hermes-agent

A vulnerability in hermes-agent allows the Secure attribute of shared cookies to not be enforced, potentially causing cookies marked as Secure to be sent over unencrypted requests. This flaw was addressed in version 2026.5.16_1.

cve-bin-tool

AIOHTTP versions from 3.4 up to but not including 3.4_4 do not enforce the Secure attribute on shared cookies. This flaw allows a shared cookie marked Secure to be transmitted over unencrypted HTTP requests, potentially exposing it to interception.

python-aiohttp

Multiple security vulnerabilities exist in python-aiohttp versions prior to 3.14.4, including improper enforcement of the Secure cookie attribute, missing keepalive timeout handling, connection pool exhaustion, unbounded file descriptor retention in multipart requests, incorrect Request.scheme handling, host-only cookie scope removal by subdomains, and ambiguous HTTP request framing leading to request smuggling. These issues are fixed in version 3.14.4.

python-aiohttp security update (CVE-2026-111063)

Multiple security vulnerabilities exist in python-aiohttp versions prior to 3.14.4, including improper enforcement of the Secure attribute on cookies, missing keepalive timeout handling, connection pool exhaustion, unbounded file descriptor retention, request scheme spoofing, cookie scope stripping, and HTTP request smuggling. These issues are fixed in version 3.14.4.

Multiple security vulnerabilities affect python-aiohttp versions prior to 3.14.4. These include improper enforcement of the Secure cookie attribute, missing keepalive timeout handling, Max-Age processing overflow, unbounded file descriptor retention in multipart requests, incorrect Request.scheme handling, removal of Host-Only cookie scope by subdomains, and ambiguous HTTP request framing allowing request smuggling. All these issues are fixed in version 3.14.4.

isponsorblocktv

A vulnerability in isponsorblocktv versions 2.9.0 and later allows the Secure attribute of shared cookies to be ignored, potentially causing these cookies to be sent over unencrypted connections.

AIOHTTP versions from 0.26.0 up to but not including 0.34.0 do not enforce the Secure attribute on shared cookies. This flaw allows a shared cookie marked as Secure to be sent over unencrypted requests, potentially exposing sensitive cookie data. The issue is fixed in version 0.34.0.

pferd

A vulnerability in AIOHTTP allows the Secure attribute of a shared cookie to be ignored, potentially causing the cookie to be sent over unencrypted requests. This affects versions from 3.4.2 up to but not including 3.10.0. The issue is fixed in version 3.10.0.

ssh-mitm

A vulnerability in AIOHTTP versions 6.0.0 up to but not including 6.0.1 allows the Secure attribute of shared cookies to not be enforced. This means a cookie marked as Secure could be sent over an unencrypted HTTP connection, potentially exposing sensitive cookie data.

scoutsuite

A vulnerability in scoutsuite versions >=5.14.0_13 and <5.14.0_18 allows the Secure attribute of shared cookies to not be enforced. This means a cookie marked as Secure could be sent over unencrypted requests, potentially exposing sensitive cookie data.

checkov

A vulnerability in AIOHTTP allows the Secure attribute of a shared cookie to not be enforced, potentially permitting the cookie to be sent over unencrypted requests. This affects versions from 2.0.615 up to but not including 3.3.30. The issue has been fixed in version 3.3.30.

moodle-dl

A vulnerability in the AIOHTTP shared cookie handling allows the Secure attribute to be ignored, potentially causing a cookie marked as Secure to be sent over unencrypted requests. This affects versions of the product moodle-dl from 2.3.13 up to but not including 2.3.13_14. The issue has a medium severity rating and a CVSS score of 6.3. A fix is available in version 2.3.13_14.

aider

A vulnerability in AIOHTTP allows the Secure attribute of a shared cookie to not be enforced, potentially permitting the cookie to be sent over unencrypted requests.

AIOHTTP versions from 1.16.2 up to but not including 1.17.1_2 do not enforce the Secure attribute on shared cookies. This flaw allows a shared cookie marked as Secure to be sent over unencrypted HTTP requests, potentially exposing sensitive session information.

streamrip

A vulnerability in streamrip versions 2.0.5 up to but not including 2.2.0 allows the Secure attribute of a shared cookie to be ignored. This means a cookie marked as Secure could be transmitted over unencrypted HTTP requests, potentially exposing sensitive cookie data. The issue is fixed in version 2.2.0.

snyk-agent-scan

A vulnerability in the Snyk agent scan affecting AIOHTTP allows the Secure attribute of a shared cookie to not be enforced. This means a cookie marked as Secure could be transmitted over unencrypted HTTP connections, potentially exposing sensitive session data. The issue affects versions from 0.4.3 up to but not including 0.6.9. A patch is available to address this vulnerability.

otterdog

A vulnerability in the otterdog product versions 1.0.1 up to but not including 1.6.1_1 allows the Secure attribute of shared cookies to not be enforced. This means that cookies marked as Secure could be sent over unencrypted connections, potentially exposing sensitive session information.

omnara

A vulnerability in the AIOHTTP library allows the Secure attribute of shared cookies to not be enforced. This means a cookie marked as Secure could be transmitted over unencrypted HTTP connections, potentially exposing it to interception.

Search: CVE-2026-111063