Hi,

The following vulnerabilities were published for python-aiohttp.

CVE-2026-111063[0]:
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio
| and Python. Prior to 3.14.4, the Secure attribute for a shared
| cookie is not enforced. An attacker can consequently cause a shared
| cookie marked Secure to be sent with an unencrypted request. This
| issue is fixed in version 3.14.4.


CVE-2026-111064[1]:
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio
| and Python. Prior to 3.14.4, keepalive timeout handling is absent
| during the initial portion of a request. An attacker can keep an
| idle connection open indefinitely before sending any request data,
| consuming server connection capacity. This issue is fixed in version
| 3.14.4.


CVE-2026-111065[2]:
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio
| and Python. Prior to 3.14.4, Max-Age processing can overflow and
| skip closing a connection. An attacker can consequently exhaust the
| connection pool temporarily until garbage collection resolves the
| connections. This issue is fixed in version 3.14.4.


CVE-2026-111066[3]:
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio
| and Python. From 2.0.0 until 3.14.4, multipart request processing
| can retain an unbounded number of open file descriptors. An
| unauthenticated attacker can consequently exhaust file descriptors
| with specially crafted multipart requests when a handler uses
| Request.post(). This issue is fixed in version 3.14.4.


CVE-2026-111748[4]:
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio
| and Python. Prior to 3.14.4, an attacker can send an absolute-form
| request that causes Request.scheme to use attacker-controlled
| request-target scheme data instead of the connection protocol.
| Applications that use Request.scheme for security decisions can
| consequently be tricked into treating an unencrypted connection as
| encrypted or an encrypted connection as unencrypted. This issue is
| fixed in version 3.14.4.


CVE-2026-111749[5]:
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio
| and Python. Prior to 3.14.4, Host-Only scope on an existing parent-
| domain cookie can be removed by a subdomain. A user who accesses an
| untrusted subdomain can consequently have host-only protections
| stripped from cookies, although impact is limited when applications
| do not reflect those cookies to a browser. This issue is fixed in
| version 3.14.4.


CVE-2026-111750[6]:
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio
| and Python. Prior to 3.14.4, the pure Python parser accepts
| ambiguous HTTP request framing. An unauthenticated attacker can
| consequently smuggle requests when an application uses
| AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and
| an intermediary interprets the framing differently. This issue is
| fixed in version 3.14.4.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-111063
https://www.cve.org/CVERecord?id=CVE-2026-111063
[1] https://security-tracker.debian.org/tracker/CVE-2026-111064
https://www.cve.org/CVERecord?id=CVE-2026-111064
[2] https://security-tracker.debian.org/tracker/CVE-2026-111065
https://www.cve.org/CVERecord?id=CVE-2026-111065
[3] https://security-tracker.debian.org/tracker/CVE-2026-111066
https://www.cve.org/CVERecord?id=CVE-2026-111066
[4] https://security-tracker.debian.org/tracker/CVE-2026-111748
https://www.cve.org/CVERecord?id=CVE-2026-111748
[5] https://security-tracker.debian.org/tracker/CVE-2026-111749
https://www.cve.org/CVERecord?id=CVE-2026-111749
[6] https://security-tracker.debian.org/tracker/CVE-2026-111750
https://www.cve.org/CVERecord?id=CVE-2026-111750

Regards,
Salvatore