{"id":"CVE-2026-111063","aliases":["GHSA-494j-54xm-rwp3"],"title":"AIOHTTP: Secure attribute not enforced for shared cookie","summary":"AIOHTTP: Secure attribute not enforced for shared cookie","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp < 3.14.4"],"patched":["aiohttp 3.14.4"],"published":"2026-10-19","updated":"2026-10-26","sourceUpdated":"2026-10-26T15:00:05.287728271Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-494j-54xm-rwp3","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111063"},{"url":"https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5"},{"url":"https://github.com/aio-libs/aiohttp"},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"},{"url":"https://github.com/advisories/GHSA-494j-54xm-rwp3"}],"tags":["osv","pip","ghsa","cve.org"],"epss":0.00233,"epssPercentile":0.14087,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-22T20:50:31.002796Z"},"cvssSource":"cna","cwe":["CWE-311","CWE-1004"],"ingestedAt":"2026-10-19T17:33:42.441Z","slug":"CVE-2026-111063","body":"## Overview\n\n### Summary\n\nThe Secure attribute was not being enforced for the shared cookie.\n\n### Impact\n\nIt may be possible to send a shared cookie marked Secure through an unencrypted request.\n\n## Affected packages\n\n- `aiohttp < 3.14.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.14.4`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":227849,"id":"CVE-2026-111063","ts":1792706831978,"field":"severity","old":"low","new":"medium"}]}