CVE-2026-111748
Received Received - Intake

AIOHTTP Scheme Spoofing via Absolute-Form Request

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111748
EUVD
EUVD-2026-104484

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aio-libs aiohttp < 3.14.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in AIOHTTP (versions before 3.14.4) allows an attacker to send a specially crafted request that manipulates the Request.scheme attribute. The scheme (HTTP/HTTPS) is incorrectly derived from the attacker-controlled request target instead of the actual connection protocol. This can trick applications into treating unencrypted connections as secure or vice versa.

Detection Guidance

To detect this vulnerability, check the version of aiohttp installed on your system. Run: pip show aiohttp. If the version is below 3.14.4, the system is vulnerable. Additionally, monitor network traffic for absolute-form requests (e.g., GET https://example.com) which may indicate exploitation attempts.

Impact Analysis

If your application uses Request.scheme for security decisions (e.g., enforcing HTTPS, validating tokens, or access controls), an attacker could bypass these protections. For example, they might trick your app into processing sensitive data over an unencrypted connection or block legitimate encrypted requests.

Compliance Impact

This vulnerability could lead to non-compliance by exposing sensitive data in transit (violating encryption requirements in GDPR Article 32 or HIPAA Security Rule). Applications relying on Request.scheme for security may fail to meet regulatory standards for data protection and integrity.

Mitigation Strategies

Upgrade aiohttp to version 3.14.4 or later immediately. If upgrading is not possible, implement a WAF rule to block absolute-form requests as a temporary workaround. Review applications using Request.scheme for security decisions to ensure they do not rely on potentially spoofed values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111748. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart