HTTP Client/Server Framework Vulnerability in AIOHTTP by aio-libs

CVE-2026-111748

What is CVE-2026-111748?

The AIOHTTP framework, utilized for building asynchronous HTTP clients and servers in Python, has a vulnerability that allows an attacker to manipulate the connection protocol via an absolute-form request. This vulnerability causes the Request.scheme function to use an attacker-defined scheme, leading to misinterpretations of connection security. Consequently, applications using Request.scheme for enforcing security measures may incorrectly classify unencrypted connections as secure or vice versa. This flaw was addressed in AIOHTTP version 3.14.4, highlighting the importance of updating to ensure secure handling of request schemes.

References