CVE-2026-111063GHSA-494j-54xm-rwp3

AIOHTTP: Secure attribute not enforced for shared cookie

aio-libs aiohttppipLibraries & packages

CVSS

6.3Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.14.4Fixed versionGitHub

Published19 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Summary

The Secure attribute was not being enforced for the shared cookie.

Impact

It may be possible to send a shared cookie marked Secure through an unencrypted request.