Aio-Libs Aiohttp vulnerabilities

CVE-2026-54275 [HIGH] CWE-297 CVE-2026-54275: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing th

CVE-2026-34513 [HIGH] CWE-770 CVE-2026-34513: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.

CVE-2026-22815 [HIGH] CWE-400 CVE-2026-22815: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.

CVE-2026-54280 [HIGH] CWE-404 CVE-2026-54280: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, pay AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or

CVE-2026-54279 [HIGH] CWE-665 CVE-2026-54279: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, hos AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

CVE-2025-69224 [MEDIUM] CWE-444 CVE-2025-69224: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker

CVE-2023-47641 [MEDIUM] CWE-444 CVE-2023-47641: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-Length(CL) and Transfer-Encoding(TE) header values are present it can lead to incorrect interpret

CVE-2026-54276 [MEDIUM] CWE-200 CVE-2026-54276: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, Dig AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only rec

CVE-2023-49082 [MEDIUM] CWE-20 CVE-2023-49082: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.

CVE-2023-49081 [MEDIUM] CWE-20 CVE-2023-49081: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request.

CVE-2025-69226 [MEDIUM] CWE-22 CVE-2025-69226: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it m

CVE-2021-21330 [MEDIUM] CWE-601 CVE-2021-21330: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before ve aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middlewa

CVE-2025-69229 [MEDIUM] CWE-770 CVE-2025-69229: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 a AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server

CVE-2025-69230 [MEDIUM] CWE-779 CVE-2025-69230: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 a AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header. This issue i

CVE-2026-34525 [MEDIUM] CWE-20 CVE-2026-34525: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.

CVE-2026-34517 [MEDIUM] CWE-770 CVE-2026-34517: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.

CVE-2026-34518 [MEDIUM] CWE-200 CVE-2026-34518: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

CVE-2026-34514 [MEDIUM] CWE-113 CVE-2026-34514: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVE-2026-34519 [MEDIUM] CWE-113 CVE-2026-34519: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVE-2025-69225 [MEDIUM] CWE-444 CVE-2025-69225: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13