Vulnerability GHSA-494j-54xm-rwp3
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
4 hours ago
October 19, 2026 at 05:07 PM UTC
AIOHTTP: Secure attribute not enforced for shared cookie
0.1 - 3.14.3
0.1 - 3.14.3
Summary
AIOHTTP: Secure attribute not enforced for shared cookie
Details
Summary
The Secure attribute was not being enforced for the shared cookie.
Impact
It may be possible to send a shared cookie marked Secure through an unencrypted request.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 hours ago
aiohttp server lacks an initial request/header timeout
0.1 - 3.14.3 GHSA-5wr8-gcqf-gqf3
0.1 - 3.14.3 GHSA-5wr8-gcqf-gqf3
High Risk
4 hours ago
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
0.1 - 3.14.3 GHSA-2g87-pp6c-29x5
0.1 - 3.14.3 GHSA-2g87-pp6c-29x5
Unknown
2 months ago
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
0.1 - 3.14.2 PYSEC-2026-3545
0.1 - 3.14.2 PYSEC-2026-3545
Unknown
2 months ago
AIOHTTP: HTTP request smuggling via WebSocket upgrade
0.1 - 3.14.1 PYSEC-2026-3546
0.1 - 3.14.1 PYSEC-2026-3546
Unknown
2 months ago
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
0.1 - 3.14.1 PYSEC-2026-3547
0.1 - 3.14.1 PYSEC-2026-3547
Impacted packages
Timeline
Published
4 hours ago
October 19, 2026 at 05:07 PM UTC
Fixed (3.14.4)
14 days ago
October 05, 2026 at 05:38 PM UTC
Last Modified
3 hours ago
October 19, 2026 at 05:15 PM UTC