{"id":"CVE-2026-111063","published":"2026-10-19T17:17:03.237","lastModified":"2026-10-19T20:55:02.217","description":"AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-311","CWE-1004"],"vendors":[],"products":[],"references":[{"url":"https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5","tags":[]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","tags":[]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3","tags":[]}],"exploitRefs":[{"url":"https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5","tags":[]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4","tags":[]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3","tags":[]}],"hasPoc":true,"ai":null}