Aio-Libs Aiohttp vulnerabilities

CVE-2025-69226 [MEDIUM] CWE-22 CVE-2025-69226: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it m

CVE-2025-69229 [MEDIUM] CWE-770 CVE-2025-69229: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 a AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server

CVE-2025-69230 [MEDIUM] CWE-779 CVE-2025-69230: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 a AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header. This issue i

CVE-2026-34518 [MEDIUM] CWE-200 CVE-2026-34518: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

CVE-2026-34514 [MEDIUM] CWE-113 CVE-2026-34514: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVE-2026-34519 [MEDIUM] CWE-113 CVE-2026-34519: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVE-2026-34525 [MEDIUM] CWE-20 CVE-2026-34525: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.

CVE-2025-69225 [MEDIUM] CWE-444 CVE-2025-69225: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13

CVE-2024-27306 [MEDIUM] CWE-79 CVE-2024-27306: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disab

CVE-2026-34517 [MEDIUM] CWE-770 CVE-2026-34517: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.

CVE-2024-42367 [MEDIUM] CWE-61 CVE-2024-42367: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static route

CVE-2026-111749 [LOW] CWE-565 CVE-2026-111749: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Hos AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect th