Pip Aiohttp vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Pip Aiohttp: 2 record(s), with affected versions and fixes.
CVE-2026-111064
High · 8.2
CWE-770 Oct 19, 2026
aiohttp server lacks an initial request/header timeout
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.
CVE-2026-111063
Medium · 6.3
CWE-311 Oct 19, 2026
AIOHTTP: Secure attribute not enforced for shared cookie
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.