PyPI/aiohttp CVE-2026-111748: medium 6.3

AIOHTTP: Absolute-form request targets can spoof Request.scheme

Action: Upgrade aiohttp to 3.14.4 or later.

pip install aiohttp==3.14.4

Affected

Fixed versions

Sources

• osv: GHSA-f9xw-jh8m-3mwq
• nvd: CVE-2026-111748
• https://github.com/aio-libs/aiohttp/security/advisories/GHSA-f9xw-jh8m-3mwq
• https://github.com/aio-libs/aiohttp/commit/6d4e7b01f9b951aa084a75d7356e907d4ee80411
• https://github.com/aio-libs/aiohttp
• https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4

CVE-2026-111748 · published 2026-10-20T20:01:40Z · modified 2026-10-20T20:15:05.218624757Z · JSON