AZL-109878 CVE-2026-111063 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4...

CVE-2026-111748

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme...

CVE-2026-111750 AIOHTTP: Pure-Python parser request smuggling

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...

CVE-2026-111750

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...

CVE-2026-111750 AIOHTTP: Pure-Python parser request smuggling

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...

CVE-2026-111750

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...

CVE-2026-111750

The AIOHTTP asynchronous HTTP client/server framework for Python and asyncio is vulnerable to HTTP request smuggling in versions prior to 3.14.4 . The issue stems from a pure Python parser that accepts ambiguous HTTP request framing. An unauthenticated attacker can smuggle requests if an applicat...

CVE-2026-111748

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme...

CVE-2026-111748

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the HTTP request parser's handling of absolute-form request targets, where the scheme supplied in the request URL is trusted without validation. When aiohttp is used as a reverse proxy or in a configuratio...

CVE-2026-111748

The AIOHTTP asynchronous HTTP client/server framework for Python and asyncio is vulnerable to a security logic flaw in versions prior to 3.14.4 . An attacker can send an absolute-form request that forces the Request.scheme attribute to use attacker-controlled request-target scheme data instead of...

CVE-2026-111066

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart...

CVE-2026-111066

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart...

CVE-2026-111064

The aiohttp asynchronous HTTP client/server framework for asyncio and Python is vulnerable to a resource exhaustion issue in versions prior to 3.14.4 . The root cause is the absence of keepalive timeout handling during the initial portion of a request, allowing an attacker to maintain idle connec...

CVE-2026-111064 aiohttp server lacks an initial request/header timeout

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection...

CVE-2026-111064 aiohttp server lacks an initial request/header timeout

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection...

Exploit for CVE-2026-85254

CVE-2026-85254 — camel-platform-http: request-header echo supp...

CVE-2026-111063 AIOHTTP: Secure attribute not enforced for shared cookie

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4...

EUVD-2026-104478

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4...

CVE-2026-111063 AIOHTTP: Secure attribute not enforced for shared cookie

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4...