CVE-2026-111748 is a vulnerability in aiohttp where an attacker can spoof the Request.scheme attribute by sending an absolute-form HTTP request. This can mislead applications relying on this attribute for security decisions, such as determining whether a connection is encrypted. The issue affects versions >=3.25.2_3 and <3.25.2_5. A fix is available in version 3.25.2_5. A workaround is to use a WAF rule to block absolute-form requests, which are typically only legitimate for proxy usage.