CVE-2026-111063
Fixed in a distro release EPSS <1%CVSS 6.3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.
Products: aio-libs aiohttp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | aiohttp | 3.14.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | 2.11.2-r14 |
| Chainguard | awx | 24.6.1-r71 |
| Chainguard | commercial-gitlab-toolbox-ee-19.1 | 19.1.9-r0 |
| Chainguard | commercial-gitlab-toolbox-ee-fips-19.1 | 19.1.9-r0 |
| Chainguard | dask-kubernetes | 2026.3.0-r18 |
| Chainguard | dask-kubernetes-fips | no fix |
| Chainguard | dask-kubernetes-fips | 2026.3.0-r15 |
| Chainguard | datahub-ingestion | 1.7.0.1-r3 |
| Chainguard | datahub-ingestion-fips | 1.7.0.1-r4 |
| Chainguard | elastic-connectors-8.19 | 8.19.23-r1 |
| Chainguard | elastic-connectors-8.19 | no fix |
| Chainguard | elastic-connectors-9.5 | 9.5.4-r2 |
| Chainguard | elastic-connectors-fips-8.19 | 8.19.23-r1 |
| Chainguard | elastic-connectors-fips-9.5 | 9.5.4-r2 |
| Chainguard | kserve-lgbserver | 0.21.0-r2 |
| Chainguard | kserve-lgbserver-fips | 0.21.0-r2 |
| Chainguard | kserve-models-web-app | 1.0.5-r2 |
| Chainguard | kserve-sklearnserver | 0.21.0-r2 |
| Chainguard | kserve-sklearnserver | no fix |
| Chainguard | kserve-storage-controller | 0.21.0-r9 |
| Chainguard | kserve-xgbserver-fips | 0.21.0-r2 |
| Chainguard | litellm-fips | 1.106.1-r1 |
| Chainguard | lmcache-cuda-12.8 | no fix |
| Chainguard | metaflow-service | 2.6.1-r5 |
| Chainguard | metaflow-service-fips | 2.6.1-r3 |
| Chainguard | nemo-gym | 0.5.0_rc0_git20260729-r4 |
| Chainguard | nemo-rl-cuda-13.0 | 0.7.0-r8 |
| Chainguard | nemo-rl-cuda-13.0-automodel | 0.7.0-r8 |
| Chainguard | nemo-rl-cuda-13.0-mcore | 0.7.0-r8 |
| Chainguard | nemo-rl-cuda-13.0-sglang | 0.7.0-r8 |
| Chainguard | nemo-rl-cuda-13.0-vllm | 0.7.0-r8 |
| Chainguard | nemo-skills | no fix |
| Chainguard | opal | 0.9.9-r5 |
| Chainguard | open-webui | 0.12.3-r3 |
| Chainguard | py3.10-vllm-cuda-12.4 | 0.18.1-r10 |
| Chainguard | py3.12-airflow-3 | 3.3.2-r5 |
| Chainguard | py3.12-vllm-cuda-12.4 | 0.18.1-r10 |
| Chainguard | py3.13-airflow-3 | 3.3.2-r5 |
| Chainguard | py3.13-scanner-test-libraries-aiohttp | 0.0.1-r6 |
| Chainguard | py3.14-airflow-3 | 3.3.2-r5 |
| Debian 12 | python-aiohttp | no fix |
| Debian 13 | python-aiohttp | no fix |
| Debian 14 | python-aiohttp | no fix |
| Ubuntu 26.10 | python-aiohttp | no fix |
| Ubuntu Pro 16.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 18.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 20.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 22.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 24.04 LTS | python-aiohttp | no fix |
| Ubuntu Pro 26.04 LTS | python-aiohttp | no fix |
| Wolfi | dask-kubernetes | 2026.3.0-r18 |
| Wolfi | kserve-storage-controller | 0.21.0-r9 |
| Wolfi | open-webui | 0.12.3-r3 |