Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-111748 · GHSA-f9xw-jh8m-3mwq

AIOHTTP: Absolute-form request targets can spoof Request.scheme

Risk score
49/100
CVSS
6.3 v4.0
Exploit chance (30 days)
0.4%
Published
19 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions…
Affected
aiohttp (pip) <= 3.14.3
Fix
Upgrade aiohttp to 3.14.4 or later.
Exploitation
No known exploitation

Story map

Story map: aiohttpTHE FLAWSTHE FIXCVE-2026-111748AIOHTTP: Absolute-formrequest targets can spoofRequest.schemeCVSS 6.3 · EPSS 0%CVE-2026-111064Aiohttp server lacks an initialrequest/header timeoutCVSS 8.2 · EPSS 0%CVE-2026-111066AIOHTTP: File descriptorexhaustion in multipartrequestsCVSS 8.2 · EPSS 0%GHSA-2g87-pp6c-29x5Multiple instances of excessiveor unbounded memory/CPU useCVSS 8.7Upgrade aiohttp3.14.4or later on your release lineWho is exposed{'products': ['aiohttp'],'packages': ['aiohttp'],'versions': ['<= 3.14.3']}AMBER · PATCH THIS WEEKaiohttpThe aiohttp server lacks aninitial request/header timeout,allowing an attacker to keep anidle connection open indefinitely,consuming server connectioncapacity.Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-807 (CWE-807)18 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

aiohttp: Amber, patch this week. The aiohttp server lacks an initial request/header timeout, allowing an attacker to keep an idle connection open indefinitely, consuming server connection capacity.

The flaws

  • CVE-2026-111748: AIOHTTP: Absolute-form request targets can spoof Request.scheme (CVSS 6.3 · EPSS 0%)
  • CVE-2026-111064: Aiohttp server lacks an initial request/header timeout (CVSS 8.2 · EPSS 0%)
  • CVE-2026-111066: AIOHTTP: File descriptor exhaustion in multipart requests (CVSS 8.2 · EPSS 0%)
  • GHSA-2g87-pp6c-29x5: Multiple instances of excessive or unbounded memory/CPU use (CVSS 8.7)

The fix

Upgrade aiohttp: 3.14.4 or later on your release line

Who is exposed: {'products': ['aiohttp'], 'packages': ['aiohttp'], 'versions': ['<= 3.14.3']}

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.3 medium
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
aiohttppip<= 3.14.33.14.4

References

Original description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.

Last activity 19 Oct 2026. Patch Forecast updates every hour.