CVE-2023-49082 — Improper Input Validation in Aiohttp

Vendor	Product	Version range	Fixed in
aio-libs	aiohttp	< 3.9.0	3.9.0
aiohttp	aiohttp	< 3.9.0	3.9.0
aiohttp	aiohttp	>= 0 < 3.9.0	3.9.0
debian	python-aiohttp	< python-aiohttp 3.8.4-1+deb12u1 (bookworm)	python-aiohttp 3.8.4-1+deb12u1 (bookworm)

VulDB

aio-libs aiohttp crlf injection (GHSA-qvrw-v9rv-5rjx / Nessus ID 212515)

vuldb·2026-06-24·CVSS 5.3

CVE-2023-49082 [MEDIUM] aio-libs aiohttp crlf injection (GHSA-qvrw-v9rv-5rjx / Nessus ID 212515) A vulnerability classified as problematic has been found in aio-libs aiohttp. Impacted is an unknown function. Performing a manipulation results in crlf injection. This vulnerability was named CVE-2023-49082. The attack needs to be approached within the local network. There is no available exploit.

OSV

python-aiohttp vulnerabilities

osv·2025-07-17·CVSS 7.5

CVE-2023-47627 [HIGH] python-aiohttp vulnerabilities python-aiohttp vulnerabilities Ben Kallus discovered that AIOHTTP did not correctly parse HTTP headers. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-47627) Ivan Novikov discovered that AIOHTTP did not properly validate certain inputs. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082) Paul J. Dorn discovered that AIOHTTP did not properly validate certain inputs. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-23829) Takes

OSV

CVE-2023-49082: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python

osv·2023-11-29·CVSS 5.3

CVE-2023-49082 [MEDIUM] CVE-2023-49082: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.

GHSA

aiohttp's ClientSession is vulnerable to CRLF injection via method

ghsa·2023-11-27

CVE-2023-49082 [MEDIUM] CWE-20 aiohttp's ClientSession is vulnerable to CRLF injection via method aiohttp's ClientSession is vulnerable to CRLF injection via method ### Summary Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. ### Details The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. Previous releases performed no validation on the provided value. If an attacker controls the HTTP method it will be used as is and can lead to HTTP request smuggling. ### PoC A minimal example can be found here: https://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b ### Impact If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). ###

OSV

aiohttp's ClientSession is vulnerable to CRLF injection via method

osv·2023-11-27

CVE-2023-49082 [MEDIUM] aiohttp's ClientSession is vulnerable to CRLF injection via method aiohttp's ClientSession is vulnerable to CRLF injection via method ### Summary Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. ### Details The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. Previous releases performed no validation on the provided value. If an attacker controls the HTTP method it will be used as is and can lead to HTTP request smuggling. ### PoC A minimal example can be found here: https://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b ### Impact If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). ###

Ubuntu

AIOHTTP vulnerabilities

vendor_ubuntu·2025-07-17·CVSS 5.3

CVE-2023-49082 [MEDIUM] AIOHTTP vulnerabilities Title: AIOHTTP vulnerabilities Summary: Several security issues were fixed in AIOHTTP. Ben Kallus discovered that AIOHTTP did not correctly parse HTTP headers. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-47627) Ivan Novikov discovered that AIOHTTP did not properly validate certain inputs. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082) Paul J. Dorn discovered that AIOHTTP did not properly validate certain inputs. A remote attacker could possibly use this issue to perform request smuggling. This issue only affected Ubuntu 20.04 LTS, Ubunt

Red Hat

aiohttp: CRLF injection if user controls the HTTP method using aiohttp client

vendor_redhat·2023-11-29·CVSS 5.3

CVE-2023-49082 [MEDIUM] CWE-93 aiohttp: CRLF injection if user controls the HTTP method using aiohttp client aiohttp: CRLF injection if user controls the HTTP method using aiohttp client aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0. A flaw was found in Aiohttp. This issue may allow an attacker to send a crafted HTTP request to the server and smuggle arbitrary HTTP headers due to improper validation of HTTP request

Debian

CVE-2023-49082: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...

vendor_debian·2023·CVSS 5.3

CVE-2023-49082 [MEDIUM] CVE-2023-49082: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ... aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0. Scope: local bookworm: resolved (fixed in 3.8.4-1+deb12u1) bullseye: resolved (fixed in 3.7.4-1+deb11u1) forky: resolved (fixed in 3.9.1-1) sid: resolved (fixed in 3.9.1-1) trixie: resolved (fixed in 3.9.1-1)

CVE-2023-49082: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP…

Affected

CVSS provenance