GHSA-494j-54xm-rwp3: Pip/aiohttp vulnerability
Published Oct 19, 2026
·Updated
Summary
The Secure attribute was not being enforced for the shared cookie.
Impact
It may be possible to send a shared cookie marked Secure through an unencrypted request.
Affected Software
1 affected componentFixes available
pip/aiohttp<=3.14.3
3.14.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.4
Event History
Oct 19, 2026
Advisory Published
via GitHub·05:07 PM
Data Sourced
via GitHub·05:07 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
Which software is affected?
The affected software is aiohttp, distributed through pip.
2
What conditions are required for exploitation?
The issue concerns shared cookies marked Secure when an unencrypted request is made. Under those conditions, the Secure attribute may not be enforced and the cookie may be sent over the unencrypted request.
3
Which release is referenced for this issue?
The advisory references the aiohttp v3.14.4 release.