AIOHTTP versions from 5.14.0_13 up to but not including 5.14.0_18 contain a vulnerability where an attacker can send an absolute-form HTTP request to spoof the Request.scheme attribute. This can mislead applications relying on this attribute for security decisions, potentially causing them to misinterpret whether a connection is encrypted. The issue is fixed in version 5.14.0_18.