CVE-2026-111748: AIOHTTP: Absolute-form request targets can spoof Request.scheme
Summary
An attacker sending an absolute-form request can spoof the scheme used.
Impact
If user code depends on the Request.scheme attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is not, or vice versa.
Workaround
A WAF rule to reject absolute-form requests (legitimate requests should only use this form for proxies).
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4 - Upgrade
Upgrade
AIOHTTPto a version that resolves this vulnerability.Fixed in 3.14.4 - Compensating control
Configure a WAF rule to reject absolute-form requests; legitimate requests should only use absolute-form for proxies.
Event History
Frequently Asked Questions
Which deployments are exposed?
AIOHTTP deployments using versions before 3.14.4 are affected if their application makes security decisions based on Request.scheme. The issue can cause the application to misidentify whether a connection is encrypted.
Does an attacker need authentication or user interaction?
No. The CVSS vector indicates no privileges or user interaction are required, but exploitation requires sending an absolute-form HTTP request target.
What should be done if upgrading cannot happen immediately?
Avoid using Request.scheme as the basis for security decisions until AIOHTTP is updated. Security checks should not trust scheme data supplied through an absolute-form request target.
How can I determine whether an application is at risk?
Check whether it uses AIOHTTP before version 3.14.4 and whether application logic relies on Request.scheme for decisions such as treating a request as encrypted or unencrypted. Test handling of absolute-form requests to identify whether the reported scheme can differ from the connection protocol.