Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-111063 · GHSA-494j-54xm-rwp3

AIOHTTP: Secure attribute not enforced for shared cookie

Risk score
45/100
CVSS
6.3 v4.0
Exploit chance (30 days)
0.2%
Published
19 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.
Affected
aiohttp (pip) <= 3.14.3
Fix
Upgrade aiohttp to 3.14.4 or later.
Exploitation
No known exploitation

Story map

Story map: aiohttpTHE FLAWSTHE FIXCVE-2026-111063AIOHTTP: Secure attribute notenforced for shared cookieCVSS 6.3 · EPSS 0%CVE-2026-111064Aiohttp server lacks an initialrequest/header timeoutCVSS 8.2 · EPSS 0%CVE-2026-111066AIOHTTP: File descriptorexhaustion in multipartrequestsCVSS 8.2 · EPSS 0%GHSA-2g87-pp6c-29x5Multiple instances of excessiveor unbounded memory/CPU useCVSS 8.7Upgrade aiohttp3.14.4or later on your release lineWho is exposed{'products': ['aiohttp'],'packages': ['aiohttp'],'versions': ['<= 3.14.3']}AMBER · PATCH THIS WEEKaiohttpThe aiohttp server lacks aninitial request/header timeout,allowing an attacker to keep anidle connection open indefinitely,consuming server connectioncapacity.Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-311 (CWE-311)2 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

aiohttp: Amber, patch this week. The aiohttp server lacks an initial request/header timeout, allowing an attacker to keep an idle connection open indefinitely, consuming server connection capacity.

The flaws

  • CVE-2026-111063: AIOHTTP: Secure attribute not enforced for shared cookie (CVSS 6.3 · EPSS 0%)
  • CVE-2026-111064: Aiohttp server lacks an initial request/header timeout (CVSS 8.2 · EPSS 0%)
  • CVE-2026-111066: AIOHTTP: File descriptor exhaustion in multipart requests (CVSS 8.2 · EPSS 0%)
  • GHSA-2g87-pp6c-29x5: Multiple instances of excessive or unbounded memory/CPU use (CVSS 8.7)

The fix

Upgrade aiohttp: 3.14.4 or later on your release line

Who is exposed: {'products': ['aiohttp'], 'packages': ['aiohttp'], 'versions': ['<= 3.14.3']}

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.3 medium
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
aiohttppip<= 3.14.33.14.4

References

Original description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.

Last activity 19 Oct 2026. Patch Forecast updates every hour.