TI-2025-38826 CVE-2025-62611 · GHSA-r397-ff8c-wv2g
aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server
Priority HIGH 75
aiomysql is a library for accessing a MySQL database from the asyncio.
aio-libs
Records60All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high13CVSS 7.0–8.9
Exploited now
aio-libs records in CISA KEVNo aio-libs vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
60 records
TI-2024-15436 CVE-2024-23334 · GHSA-5h86-8mv2-jq9f
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
Priority HIGH 72
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-25769 CVE-2023-47627 · GHSA-gfw2-4jvh-wgfg
Request smuggling in aiohttp
Priority HIGH 72
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-18906 CVE-2023-37276 · GHSA-45c4-8wx5-qw6w
aiohttp vulnerable to HTTP request smuggling
Priority HIGH 72
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-26746 CVE-2023-49081 · GHSA-q3qx-c6g2-7pw2
aiohttp's ClientSession is vulnerable to CRLF injection via version
Priority HIGH 65
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-66145 CVE-2026-104874 · GHSA-54p9-h82j-f925
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Priority MEDIUM 63
Multidict is an implementation of a multidict data structure.
TI-2023-26747 CVE-2023-49082 · GHSA-qvrw-v9rv-5rjx
aiohttp's ClientSession is vulnerable to CRLF injection via method
Priority MEDIUM 63
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2024-34978 CVE-2024-52303 · GHSA-27mf-ghqm-j3j8
aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
Priority MEDIUM 44
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-76527 CVE-2026-111064 · GHSA-5wr8-gcqf-gqf3
Missing initial request timeout in aiohttp server
Priority MEDIUM 42
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2024-19997 CVE-2024-30251 · GHSA-5m98-qgg9-wh84
Denial of service when trying to parse malformed POST requests in aiohttp
Priority MEDIUM 41
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2025-42677 CVE-2025-69223 · GHSA-6mq8-rvhq-8wgg
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Priority MEDIUM 40
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-76528 CVE-2026-111065 · GHSA-6cjc-53gc-5rqm
Connector pool exhaustion in AIOHTTP via Max-Age overflow
Priority LOW 37
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-18331 CVE-2026-22815 · GHSA-w2fm-2cpv-w7v5
AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers
Priority LOW 37
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2024-15823 CVE-2024-23829 · GHSA-8qpw-xqxj-h4r2
aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
Priority LOW 37
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-76529 CVE-2026-111066 · GHSA-9xw5-w5jj-pvcg
File descriptor exhaustion in AIOHTTP multipart request processing
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-76526 CVE-2026-111063 · GHSA-494j-54xm-rwp3
AIOHTTP does not enforce the Secure attribute on shared cookies
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-39178 CVE-2026-54278 · GHSA-g3cq-j2xw-wf74
AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-39177 CVE-2026-54277 · GHSA-63hw-fmq6-xxg2
AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-39174 CVE-2026-54274 · GHSA-xcgm-r5h9-7989
AIOHTTP: Incomplete websocket frame payloads bypass memory limits
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-39173 CVE-2026-54273 · GHSA-4fvr-rgm6-gqmc
AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-26766 CVE-2026-34516 · GHSA-m5qp-6w8w-w647
AIOHTTP: Multipart Header Size Bypass
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-26765 CVE-2026-34515 · GHSA-p998-jp59-783m
AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2025-31083 CVE-2025-48945
pycares has a Use-After-Free Vulnerability
Priority LOW 36
pycares is a Python module which provides an interface to c-ares.
TI-2025-42683 CVE-2025-69229 · GHSA-g84x-mcqj-x9qq
AIOHTTP vulnerable to DoS through chunked messages
Priority LOW 35
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2025-42682 CVE-2025-69228 · GHSA-6jhg-hg63-jvvf
AIOHTTP vulnerable to denial of service through large payloads
Priority LOW 35
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.