Aiohttp

Records44All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

Aiohttp records in CISA KEV

No Aiohttp vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Aiohttp 44 records HIGH

Records

44 records

TI-2024-15436 CVE-2024-23334 · GHSA-5h86-8mv2-jq9f

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

HIGH 72

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.76875 Published 2024-01-29 Partial fix · 3.9.2 CWE-22

TI-2023-25769 CVE-2023-47627 · GHSA-gfw2-4jvh-wgfg

Request smuggling in aiohttp

HIGH 72

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00857 Published 2023-11-14 Fixed in 3.8.6 CWE-444

TI-2023-18906 CVE-2023-37276 · GHSA-45c4-8wx5-qw6w

aiohttp vulnerable to HTTP request smuggling

HIGH 72

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01337 Published 2023-07-19 Partial fix · 3.8.5 CWE-444

TI-2023-26746 CVE-2023-49081 · GHSA-q3qx-c6g2-7pw2

aiohttp's ClientSession is vulnerable to CRLF injection via version

HIGH 65

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00882 Published 2023-11-30 Partial fix · 3.9.0 CWE-20

TI-2023-26747 CVE-2023-49082 · GHSA-qvrw-v9rv-5rjx

aiohttp's ClientSession is vulnerable to CRLF injection via method

MEDIUM 63

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00948 Published 2023-11-29 Partial fix · 3.9.0 CWE-20

TI-2024-34978 CVE-2024-52303 · GHSA-27mf-ghqm-j3j8

aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method

MEDIUM 44

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00591 Published 2024-11-18 Partial fix · 3.10.11 CWE-772

TI-2024-19997 CVE-2024-30251 · GHSA-5m98-qgg9-wh84

Denial of service when trying to parse malformed POST requests in aiohttp

MEDIUM 41

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01094 Published 2024-05-02 Partial fix · 3.9.4 CWE-835

TI-2025-42677 CVE-2025-69223 · GHSA-6mq8-rvhq-8wgg

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

MEDIUM 40

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00583 Published 2026-01-05 Partial fix · 3.13.3 CWE-409

TI-2026-18331 CVE-2026-22815 · GHSA-w2fm-2cpv-w7v5

AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

LOW 37

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00457 Published 2026-04-01 Partial fix · 3.13.4 CWE-400

TI-2024-15823 CVE-2024-23829 · GHSA-8qpw-xqxj-h4r2

aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

LOW 37

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01029 Published 2024-01-29 Partial fix · 3.9.2 CWE-444

TI-2026-39178 CVE-2026-54278 · GHSA-g3cq-j2xw-wf74

AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00493 Published 2026-06-22 Partial fix · 3.14.1 CWE-409

TI-2026-39177 CVE-2026-54277 · GHSA-63hw-fmq6-xxg2

AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00563 Published 2026-06-22 Partial fix · 3.14.1 CWE-770

TI-2026-39174 CVE-2026-54274 · GHSA-xcgm-r5h9-7989

AIOHTTP: Incomplete websocket frame payloads bypass memory limits

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00539 Published 2026-06-22 Partial fix · 3.14.1 CWE-770

TI-2026-39173 CVE-2026-54273 · GHSA-4fvr-rgm6-gqmc

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00493 Published 2026-06-22 Partial fix · 3.14.1 CWE-770

TI-2026-26766 CVE-2026-34516 · GHSA-m5qp-6w8w-w647

AIOHTTP: Multipart Header Size Bypass

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00457 Published 2026-04-01 Partial fix · 3.13.4 CWE-770

TI-2026-26765 CVE-2026-34515 · GHSA-p998-jp59-783m

AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.0045 Published 2026-04-01 Fixed in 3.13.4 CWE-36

TI-2025-42683 CVE-2025-69229 · GHSA-g84x-mcqj-x9qq

AIOHTTP vulnerable to DoS through chunked messages

LOW 35

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00404 Published 2026-01-05 Partial fix · 3.13.3 CWE-770

TI-2025-42682 CVE-2025-69228 · GHSA-6jhg-hg63-jvvf

AIOHTTP vulnerable to denial of service through large payloads

LOW 35

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00407 Published 2026-01-05 Partial fix · 3.13.3 CWE-770

TI-2025-42681 CVE-2025-69227 · GHSA-jj3x-wxrx-4x23

AIOHTTP vulnerable to DoS when bypassing asserts

LOW 35

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00396 Published 2026-01-05 Partial fix · 3.13.3 CWE-835

TI-2024-34979 CVE-2024-52304 · GHSA-8495-4g3g-x7pr

aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

LOW 35

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00563 Published 2024-11-18 Partial fix · 3.10.11 CWE-444

TI-2026-34845 CVE-2026-47265 · GHSA-hg6j-4rv6-33pg

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

LOW 34

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.0015 Published 2026-06-02 Partial fix · 3.14.0 CWE-346

TI-2026-27214 CVE-2026-34993 · GHSA-jg22-mg44-37j8

AIOHTTP Vulnerable to Deserialization of Untrusted Data

LOW 31

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00179 Published 2026-06-02 Partial fix · 3.14.0 CWE-502

TI-2021-04430 CVE-2021-21330 · GHSA-v6wp-4m6f-gcjg

Open redirect vulnerability in aiohttp

LOW 31

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01905 Published 2021-02-26 Fixed in 3.7.4 CWE-601

TI-2023-25781 CVE-2023-47641 · GHSA-xx9p-xxvh-7g8j

Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp

LOW 30

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00834 Published 2023-11-14 Fixed in 3.8.0 CWE-444

TI-2026-39176 CVE-2026-54276 · GHSA-hpj7-wq8m-9hgp

AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

LOW 28

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00307 Published 2026-06-22 Partial fix · 3.14.1 CWE-200

Open these records in search →

Critical	0
High	8
Medium	23
Low	13
No CVSS	0