CVE-2026-111748: AIOHTTP: Absolute-form request targets can spoof Request.scheme
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4
Event History
Frequently Asked Questions
Which deployments are exposed?
AIOHTTP deployments using versions before 3.14.4 are affected if their application makes security decisions based on Request.scheme. The issue can cause the application to misidentify whether a connection is encrypted.
Does an attacker need authentication or user interaction?
No. The CVSS vector indicates no privileges or user interaction are required, but exploitation requires sending an absolute-form HTTP request target.
What should be done if upgrading cannot happen immediately?
Avoid using Request.scheme as the basis for security decisions until AIOHTTP is updated. Security checks should not trust scheme data supplied through an absolute-form request target.
How can I determine whether an application is at risk?
Check whether it uses AIOHTTP before version 3.14.4 and whether application logic relies on Request.scheme for decisions such as treating a request as encrypted or unencrypted. Test handling of absolute-form requests to identify whether the reported scheme can differ from the connection protocol.