{"id":"CVE-2026-111748","aliases":["GHSA-f9xw-jh8m-3mwq"],"url":"https://o3.security/vulnerability/CVE-2026-111748","summary":"AIOHTTP: Absolute-form request targets can spoof Request.scheme","details":"### Summary\n\nAn attacker sending an absolute-form request can spoof the scheme used.\n\n### Impact\n\nIf user code depends on the `Request.scheme` attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is not, or vice versa.\n\n### Workaround\n\nA WAF rule to reject absolute-form requests (legitimate requests should only use this form for proxies).","published":"2026-10-19T17:02:21.289Z","modified":"2026-10-24T02:48:41.271461184Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"aiohttp","fixedVersion":"3.14.4"}],"fix":{"url":"https://github.com/aio-libs/aiohttp/commit/6d4e7b01f9b951aa084a75d7356e907d4ee80411","label":"aio-libs/aiohttp@6d4e7b0"},"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111748.json"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-f9xw-jh8m-3mwq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111748"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/6d4e7b01f9b951aa084a75d7356e907d4ee80411"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:48:41.271461184Z"}}