CVE-2026-111748
Last modified
CVE-2026-111748 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| aio-libs | aiohttp | < 3.14.4 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-111748?
How severe is CVE-2026-111748?
How do I fix CVE-2026-111748?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-111735P-Net before 1.0.3 contains an integer underflow in pf_cpm_c…7.1
- CVE-2026-111736P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm…8.7
- CVE-2026-111737The Speed Optimizer WordPress plugin before 7.8.5 does not …3.5
- CVE-2026-111738The Speed Optimizer WordPress plugin before 7.8.5 does not …5.5
- CVE-2026-111739The Two Factor Authentication WordPress plugin before 1.17.0…7.5
- CVE-2026-11174Inappropriate implementation in Site Isolation in Google Chr…5.3
- CVE-2026-111749AIOHTTP is an asynchronous HTTP client/server framework for …2.3
- CVE-2026-11175Incorrect security UI in Messages in Google Chrome on Androi…8.8
- CVE-2026-111750AIOHTTP is an asynchronous HTTP client/server framework for …6.3
- CVE-2026-111755follow-redirects is a Node.js HTTP and HTTPS client wrapper …8.2
- CVE-2026-111756follow-redirects is a Node.js HTTP and HTTPS client wrapper …8.2
- CVE-2026-111757Hono is a Web application framework that provides support fo…5.3
Are you affected by CVE-2026-111748?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST