GHSA-494j-54xm-rwp3

AIOHTTP: Secure attribute not enforced for shared cookie

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-111063

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	aiohttp	< 3.14.4	3.14.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary The Secure attribute was not being enforced for the shared cookie. ### Impact It may be possible to send a shared cookie marked Secure through an unencrypted request.

References

External links from the advisory. They lead to third-party sites.

https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3 web
https://nvd.nist.gov/vuln/detail/CVE-2026-111063 advisory
https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5 web
https://github.com/aio-libs/aiohttp package
https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4 web