CVE-2023-49081
published 2023-11-30CVE-2023-49081: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.88%
55.2th percentile
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.9.0 | 3.9.0 |
| aiohttp | aiohttp | < 3.9.0 | 3.9.0 |
| aiohttp | aiohttp | >= 0 < 3.9.0 | 3.9.0 |
| debian | python-aiohttp | < python-aiohttp 3.8.4-1+deb12u1 (bookworm) | python-aiohttp 3.8.4-1+deb12u1 (bookworm) |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
osv7.5HIGH
vendor_debian7.2HIGH
vendor_redhat7.2HIGH
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
aio-libs aiohttp ClientSession crlf injection (GHSA-q3qx-c6g2-7pw2 / Nessus ID 212515)
vuldb·2026-06-24·CVSS 5.3
CVE-2023-49081 [MEDIUM] aio-libs aiohttp ClientSession crlf injection (GHSA-q3qx-c6g2-7pw2 / Nessus ID 212515)
A vulnerability described as problematic has been identified in aio-libs aiohttp. This issue affects some unknown processing of the component ClientSession. Such manipulation leads to crlf injection.
This vulnerability is uniquely identified as CVE-2023-49081. The attack can only be initiated within the local network. No exploit exists.
OSV
python-aiohttp vulnerabilities
osv·2025-07-17·CVSS 7.5
CVE-2023-47627 [HIGH] python-aiohttp vulnerabilities
python-aiohttp vulnerabilities
Ben Kallus discovered that AIOHTTP did not correctly parse HTTP
headers. A remote attacker could possibly use this issue to perform
request smuggling. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-47627)
Ivan Novikov discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082)
Paul J. Dorn discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2024-23829)
Takes
OSV
CVE-2023-49081: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
osv·2023-11-30·CVSS 5.3
CVE-2023-49081 [MEDIUM] CVE-2023-49081: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
GHSA
aiohttp's ClientSession is vulnerable to CRLF injection via version
ghsa·2023-11-27
CVE-2023-49081 [MEDIUM] CWE-20 aiohttp's ClientSession is vulnerable to CRLF injection via version
aiohttp's ClientSession is vulnerable to CRLF injection via version
### Summary
Improper validation make it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or even create a new HTTP request if the attacker controls the HTTP version.
### Details
The vulnerability only occurs if the attacker can control the HTTP version of the request (including its type).
For example if an unvalidated JSON value is used as a version and the attacker is then able to pass an array as the `version` parameter.
Furthermore, the vulnerability only occurs when the `Connection` header is passed to the `headers` parameter.
At this point, the library will use the parsed value to create the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF
OSV
aiohttp's ClientSession is vulnerable to CRLF injection via version
osv·2023-11-27
CVE-2023-49081 [MEDIUM] aiohttp's ClientSession is vulnerable to CRLF injection via version
aiohttp's ClientSession is vulnerable to CRLF injection via version
### Summary
Improper validation make it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or even create a new HTTP request if the attacker controls the HTTP version.
### Details
The vulnerability only occurs if the attacker can control the HTTP version of the request (including its type).
For example if an unvalidated JSON value is used as a version and the attacker is then able to pass an array as the `version` parameter.
Furthermore, the vulnerability only occurs when the `Connection` header is passed to the `headers` parameter.
At this point, the library will use the parsed value to create the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF
Ubuntu
AIOHTTP vulnerabilities
vendor_ubuntu·2025-07-17·CVSS 5.3
CVE-2023-49082 [MEDIUM] AIOHTTP vulnerabilities
Title: AIOHTTP vulnerabilities
Summary: Several security issues were fixed in AIOHTTP.
Ben Kallus discovered that AIOHTTP did not correctly parse HTTP
headers. A remote attacker could possibly use this issue to perform
request smuggling. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-47627)
Ivan Novikov discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082)
Paul J. Dorn discovered that AIOHTTP did not properly validate certain
inputs. A remote attacker could possibly use this issue to perform request
smuggling. This issue only affected Ubuntu 20.04 LTS, Ubunt
Red Hat
aiohttp: HTTP request modification
vendor_redhat·2023-11-30·CVSS 7.2
CVE-2023-49081 [HIGH] CWE-20 aiohttp: HTTP request modification
aiohttp: HTTP request modification
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
A flaw was found in the python-aiohttp package. This issue could allow a remote attacker to modify an existing HTTP request or create a new request that could have minor confidentiality or integrity impacts.
Package: aiohttp (Red Hat Ansible Automation Platform 1.2) - Will not fix
Package: tfm-pulpcore-python-aiohttp (Red Hat Satellite 6) - Out of support scop
Debian
CVE-2023-49081: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...
vendor_debian·2023·CVSS 7.2
CVE-2023-49081 [HIGH] CVE-2023-49081: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
Scope: local
bookworm: resolved (fixed in 3.8.4-1+deb12u1)
bullseye: resolved (fixed in 3.7.4-1+deb11u1)
forky: resolved (fixed in 3.9.1-1)
sid: resolved (fixed in 3.9.1-1)
trixie: resolved (fixed in 3.9.1-1)
No detection rules found.
No public exploits indexed.
https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508ehttps://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013bhttps://github.com/aio-libs/aiohttp/pull/7835/fileshttps://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508ehttps://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013bhttps://github.com/aio-libs/aiohttp/pull/7835/fileshttps://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2https://lists.debian.org/debian-lts-announce/2025/02/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A/
2023-11-30
Published