Aio-Libs Aiohttp vulnerabilities

CVE-2024-23334 [HIGH] CWE-22 CVE-2024-23334: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp a aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_

CVE-2026-34520 [CRITICAL] CWE-113 CVE-2026-34520: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

CVE-2026-111066 [HIGH] CWE-400 CVE-2026-111066: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue i

CVE-2026-111064 [HIGH] CWE-770 CVE-2026-111064: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, kee AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

CVE-2024-52304 [HIGH] CWE-444 CVE-2024-52304: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_E

CVE-2025-53643 [HIGH] CWE-444 CVE-2025-53643: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled

CVE-2026-111750 [MEDIUM] CWE-444 CVE-2026-111750: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the fr

CVE-2023-37276 [HIGH] CWE-444 CVE-2023-37276: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and e aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.

CVE-2025-69223 [HIGH] CWE-409 CVE-2025-69223: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

CVE-2024-30251 [HIGH] CWE-835 CVE-2024-30251: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving r

CVE-2026-50269 [HIGH] CWE-93 CVE-2026-50269: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, att AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=.

CVE-2026-34515 [HIGH] CWE-36 CVE-2026-34515: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.

CVE-2026-111748 [MEDIUM] CWE-807 CVE-2026-111748: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked in

CVE-2026-54277 [HIGH] CWE-770 CVE-2026-54277: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessiv

CVE-2026-54278 [HIGH] CWE-409 CVE-2026-54278: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, dur AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip b

CVE-2025-69228 [HIGH] CWE-770 CVE-2025-69228: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhaust

CVE-2025-69227 [HIGH] CWE-835 CVE-2025-69227: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post

CVE-2026-34993 [HIGH] CWE-502 CVE-2026-34993: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue.

CVE-2024-52303 [HIGH] CWE-772 CVE-2024-52303: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker ma

CVE-2026-54274 [HIGH] CWE-770 CVE-2026-54274: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.