CVE-2026-111748 is a vulnerability in vdirsyncer versions >=0.19.0 and <0.21.0_2 where an attacker can spoof the Request.scheme attribute by sending an absolute-form HTTP request. This can mislead applications relying on Request.scheme for security decisions, potentially causing them to incorrectly assume a connection is encrypted or not. A patch is available in version 0.21.0_2. A workaround is to use a WAF rule to reject absolute-form requests, which are typically only legitimate for proxies.