Multiple security vulnerabilities affect python-aiohttp versions prior to 3.14.4. These include improper enforcement of the Secure cookie attribute, missing keepalive timeout handling, Max-Age processing overflow, unbounded file descriptor retention in multipart requests, incorrect Request.scheme handling, removal of Host-Only cookie scope by subdomains, and ambiguous HTTP request framing allowing request smuggling. All these issues are fixed in version 3.14.4.