TI-2024-15436 CVE-2024-23334 · GHSA-5h86-8mv2-jq9f
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
Priority HIGH 72
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
Aiohttp
Records44All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9
Exploited now
Aiohttp records in CISA KEVNo Aiohttp vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
44 records in Aiohttp · all components
TI-2023-25769 CVE-2023-47627 · GHSA-gfw2-4jvh-wgfg
Request smuggling in aiohttp
Priority HIGH 72
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-18906 CVE-2023-37276 · GHSA-45c4-8wx5-qw6w
aiohttp vulnerable to HTTP request smuggling
Priority HIGH 72
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-26746 CVE-2023-49081 · GHSA-q3qx-c6g2-7pw2
aiohttp's ClientSession is vulnerable to CRLF injection via version
Priority HIGH 65
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-26747 CVE-2023-49082 · GHSA-qvrw-v9rv-5rjx
aiohttp's ClientSession is vulnerable to CRLF injection via method
Priority MEDIUM 63
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2024-34978 CVE-2024-52303 · GHSA-27mf-ghqm-j3j8
aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
Priority MEDIUM 44
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2024-19997 CVE-2024-30251 · GHSA-5m98-qgg9-wh84
Denial of service when trying to parse malformed POST requests in aiohttp
Priority MEDIUM 41
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2025-42677 CVE-2025-69223 · GHSA-6mq8-rvhq-8wgg
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Priority MEDIUM 40
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-18331 CVE-2026-22815 · GHSA-w2fm-2cpv-w7v5
AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers
Priority LOW 37
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2024-15823 CVE-2024-23829 · GHSA-8qpw-xqxj-h4r2
aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
Priority LOW 37
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-39178 CVE-2026-54278 · GHSA-g3cq-j2xw-wf74
AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-39177 CVE-2026-54277 · GHSA-63hw-fmq6-xxg2
AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-39174 CVE-2026-54274 · GHSA-xcgm-r5h9-7989
AIOHTTP: Incomplete websocket frame payloads bypass memory limits
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-39173 CVE-2026-54273 · GHSA-4fvr-rgm6-gqmc
AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-26766 CVE-2026-34516 · GHSA-m5qp-6w8w-w647
AIOHTTP: Multipart Header Size Bypass
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-26765 CVE-2026-34515 · GHSA-p998-jp59-783m
AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
Priority LOW 36
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2025-42683 CVE-2025-69229 · GHSA-g84x-mcqj-x9qq
AIOHTTP vulnerable to DoS through chunked messages
Priority LOW 35
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2025-42682 CVE-2025-69228 · GHSA-6jhg-hg63-jvvf
AIOHTTP vulnerable to denial of service through large payloads
Priority LOW 35
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2025-42681 CVE-2025-69227 · GHSA-jj3x-wxrx-4x23
AIOHTTP vulnerable to DoS when bypassing asserts
Priority LOW 35
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2024-34979 CVE-2024-52304 · GHSA-8495-4g3g-x7pr
aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions
Priority LOW 35
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-34845 CVE-2026-47265 · GHSA-hg6j-4rv6-33pg
AIOHTTP vulnerable to cross-origin redirect with per-request cookies
Priority LOW 34
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-27214 CVE-2026-34993 · GHSA-jg22-mg44-37j8
AIOHTTP Vulnerable to Deserialization of Untrusted Data
Priority LOW 31
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2021-04430 CVE-2021-21330 · GHSA-v6wp-4m6f-gcjg
Open redirect vulnerability in aiohttp
Priority LOW 31
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2023-25781 CVE-2023-47641 · GHSA-xx9p-xxvh-7g8j
Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp
Priority LOW 30
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-39176 CVE-2026-54276 · GHSA-hpj7-wq8m-9hgp
AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
Priority LOW 28
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.