GitHub Advisoryadvisory · PyPI

GHSA-494j-54xm-rwp3 AIOHTTP: Secure attribute not enforced for shared cookie

MEDIUM Published 2026-10-19 Modified 2026-10-26 Official page ↗

Aliases: CVE-2026-111063
Ecosystem: PyPI
Packages: aiohttp
Severity: Moderate
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses: CWE-1004, CWE-311
Reviewed: 2026-10-19

Affected packages

• PyPI aiohttp: < 3.14.4 → fixed in 3.14.4

Description

Summary The Secure attribute was not being enforced for the shared cookie. Impact It may be possible to send a shared cookie marked Secure through an unencrypted request.

Alias · CVE (1)

CVE-2026-111063 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. vulnerability

Weakness · CWE (2)

CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag weakness
CWE-311 Missing Encryption of Sensitive Data weakness

References

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3 web
https://nvd.nist.gov/vuln/detail/CVE-2026-111063 advisory
https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5 web
https://github.com/aio-libs/aiohttp package
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4 web