~ / search / GHSA-f9xw-jh8m-3mwq

GHSA-f9xw-jh8m-3mwq

AIOHTTP: Absolute-form request targets can spoof Request.scheme

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-111748

Packages

EcosystemPackageAffectedFixed in
PyPI aiohttp < 3.14.4 3.14.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary An attacker sending an absolute-form request can spoof the scheme used. ### Impact If user code depends on the `Request.scheme` attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is not, or vice versa. ### Workaround A WAF rule to reject absolute-form requests (legitimate requests should only use this form for proxies).

References

External links from the advisory. They lead to third-party sites.