Aio-Libs Aiohttp vulnerabilities

CVE-2024-23334 [HIGH] CWE-22 CVE-2024-23334: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp a aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_

CVE-2026-34520 [CRITICAL] CWE-113 CVE-2026-34520: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

CVE-2024-52304 [HIGH] CWE-444 CVE-2024-52304: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_E

CVE-2023-37276 [HIGH] CWE-444 CVE-2023-37276: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and e aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.

CVE-2025-53643 [HIGH] CWE-444 CVE-2025-53643: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled

CVE-2024-30251 [HIGH] CWE-835 CVE-2024-30251: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving r

CVE-2025-69223 [HIGH] CWE-409 CVE-2025-69223: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

CVE-2026-34515 [HIGH] CWE-36 CVE-2026-34515: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.

CVE-2025-69228 [HIGH] CWE-770 CVE-2025-69228: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhaust

CVE-2025-69227 [HIGH] CWE-835 CVE-2025-69227: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post

CVE-2026-50269 [HIGH] CWE-93 CVE-2026-50269: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, att AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=.

CVE-2024-52303 [HIGH] CWE-772 CVE-2024-52303: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker ma

CVE-2026-34516 [HIGH] CWE-770 CVE-2026-34516: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.

CVE-2026-54278 [HIGH] CWE-409 CVE-2026-54278: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, dur AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip b

CVE-2026-54277 [HIGH] CWE-770 CVE-2026-54277: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessiv

CVE-2026-54274 [HIGH] CWE-770 CVE-2026-54274: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

CVE-2026-47265 [HIGH] CWE-346 CVE-2026-47265: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a

CVE-2026-34993 [HIGH] CWE-502 CVE-2026-34993: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue.

CVE-2023-47627 [HIGH] CWE-444 CVE-2023-47627: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in A aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been

CVE-2026-54273 [HIGH] CWE-770 CVE-2026-54273: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.