{"action":"Upgrade aiohttp to 3.14.4 or later.","affected":[{"fixed":"3.14.4","introduced":"0"}],"component":"aiohttp","cve_ids":["CVE-2026-111748"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["3.14.4"],"ghsa_id":"GHSA-f9xw-jh8m-3mwq","id":"tcs_01M5JK8WE8VBYMVQAC20AYTVN3","modified_at":"2026-10-20T20:15:05.218624757Z","published_at":"2026-10-20T20:01:40Z","references":["https://osv.dev/vulnerability/GHSA-f9xw-jh8m-3mwq","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-f9xw-jh8m-3mwq","https://nvd.nist.gov/vuln/detail/CVE-2026-111748","https://github.com/aio-libs/aiohttp/commit/6d4e7b01f9b951aa084a75d7356e907d4ee80411","https://github.com/aio-libs/aiohttp","https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-f9xw-jh8m-3mwq","url":"https://osv.dev/vulnerability/GHSA-f9xw-jh8m-3mwq"},{"source":"nvd","source_id":"CVE-2026-111748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111748"}],"summary":"AIOHTTP: Absolute-form request targets can spoof Request.scheme"}