CVE-2026-111063: AIOHTTP: Secure attribute not enforced for shared cookie
Summary
The Secure attribute was not being enforced for the shared cookie.
Impact
It may be possible to send a shared cookie marked Secure through an unencrypted request.
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4 - Upgrade
Upgrade
AIOHTTPto a version that resolves this vulnerability.Fixed in 3.14.4
Event History
Frequently Asked Questions
Which deployments are affected?
Applications using aiohttp versions prior to 3.14.4 are affected when they use shared cookies marked Secure. Version 3.14.4 contains the fix.
What must an attacker be able to cause for exploitation?
An attacker must be able to cause the application to make an unencrypted request in a situation where a shared cookie marked Secure is available. The vulnerable behavior can send that cookie with the unencrypted request.
What is the mitigation if upgrading is not immediately possible?
Avoid making unencrypted requests where shared Secure cookies could be used. Upgrading aiohttp to version 3.14.4 is the documented fix.