CVE-2026-111748 is a vulnerability in pferd versions 3.4.2 up to but not including 3.10.0 where an attacker can spoof the Request.scheme attribute by sending an absolute-form HTTP request. This can mislead applications relying on Request.scheme for security decisions, potentially causing them to misinterpret whether a connection is encrypted. A workaround is to use a WAF rule to reject absolute-form requests, which are typically only legitimate for proxies. A fix is available in version 3.10.0.