CVE-2026-111748
published 2026-10-19CVE-2026-111748: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes…
PriorityP344medium6.3CVSS 4.0
AVNACLATPPRNUINVCLVILVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.36%
29.2th percentile
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.
Affected
124 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.14.4 | 3.14.4 |
| aiohttp | aiohttp | >= 0 < 3.14.4 | 3.14.4 |
| ansible-automation-platform-24 | controller-rhel8 | — | — |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | controller-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-supported-rhel9 | — | — |
| ansible-automation-platform-26 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-26 | platform-resource-runner-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| ansible-automation-platform-27 | ee-control-plane-rhel9 | — | — |
| ansible-automation-platform-27 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
CVSS provenance
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
aiohttp: aiohttp: Security control bypass via request scheme spoofing
vendor_redhat·2026-10-19·CVSS 6.3
CVE-2026-111748 [MEDIUM] CWE-348 aiohttp: aiohttp: Security control bypass via request scheme spoofing
aiohttp: aiohttp: Security control bypass via request scheme spoofing
A flaw was found in aiohttp. A remote attacker can bypass security controls by sending an absolute-form HTTP request that spoofs the connection protocol scheme. This issue occurs because the framework evaluates attacker-controlled request-target data rather than verifying the underlying connection protocol. Consequently, applications that rely on the reported scheme to make security decisions may mistakenly treat unencrypted connections as encrypted, potentially leading to unauthorized access or policy circumvention.
Package: exploit-intelligence/vulnerability-analysis-rhel9 (Exploit Intelligence) - Out of support scope
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Fix deferred
Package: lightspe
GHSA
AIOHTTP: Absolute-form request targets can spoof Request.scheme
ghsa·2026-10-20
CVE-2026-111748 [MEDIUM] CWE-807 AIOHTTP: Absolute-form request targets can spoof Request.scheme
AIOHTTP: Absolute-form request targets can spoof Request.scheme
### Summary
An attacker sending an absolute-form request can spoof the scheme used.
### Impact
If user code depends on the `Request.scheme` attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is not, or vice versa.
### Workaround
A WAF rule to reject absolute-form requests (legitimate requests should only use this form for proxies).
VulDB
aio-libs aiohttp up to 3.14.3 input validation (EUVD-2026-104484 / Nessus ID 367858)
vuldb·2026-10-20·CVSS 6.3
CVE-2026-111748 [MEDIUM] aio-libs aiohttp up to 3.14.3 input validation (EUVD-2026-104484 / Nessus ID 367858)
A vulnerability has been found in aio-libs aiohttp up to 3.14.3 and classified as critical. Affected by this issue is some unknown functionality. This manipulation causes improper input validation.
This vulnerability is tracked as CVE-2026-111748. The attack is possible to be carried out remotely. No exploit exists.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-19
Published