high
CVE-2026-111750
aiohttp before 3.14.4: seven advisories in one release - request smuggling via ambiguous framing in the pure-Python parser, an attacker-chosen Request.scheme, two unenforced cookie protections, and three ways to hold a connection or a file descriptor open
- Severity
- high
- Affected product
- aiohttp
- Affected versions
- aiohttp < 3.14.4
- Fixed in
- aiohttp 3.14.4
- Detection basis
- Component version range
- Shipped rule
- aiohttp: aiohttp before 3.14.4: seven advisories in one release - request smuggling via ambiguous framing in the pure-Python parser, an attacker-chosen Request.scheme, two unenforced cookie protections, and three ways to hold a connection or a file descriptor open
- Added to NewScan
- 2026-10-20
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints aiohttp from its response and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.