Open redirect vulnerability in aiohttp
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.
Summary
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aio-libs | aiohttp | before 3.7.4 | 3.7.4 | Patch available | CNA |
| — | aiohttp (PyPI) | before 3.7.4 | 3.7.4 | Patch available | GHSA-v6wp-4m6f-gcjg |
- aiohttp Vendoraio-libs Affected before 3.7.4 Fixed in 3.7.4 Patch available CNA
- aiohttp (PyPI) Vendor— Affected before 3.7.4 Fixed in 3.7.4 Patch available GHSA-v6wp-4m6f-gcjg
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* | before 3.7.4 | Vulnerable | Aiohttp |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
- cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* Versions before 3.7.4 Vulnerable ·Aiohttp
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA aiohttp (aio-libs) Fixed in 3.7.4
- Fix · GHSA-v6wp-4m6f-gcjg aiohttp (PyPI) Fixed in 3.7.4 Advisory →
Red Hat 1 advisory
- RHSA-2021:4702 Released 2021-11-16 · Red Hat rating ModerateSatellite 6.10 Release
- Red Hat Satellite 6.10 candlepin-4.0.9-1.el7sat, foreman-2.5.2.17-2.el7sat, python-aiohttp-3.7.4-1.el7pc +14
- Red Hat Satellite Capsule 6.10 foreman-2.5.2.17-2.el7sat, python-aiohttp-3.7.4-1.el7pc, python-ecdsa-0.13.3-2.el7pc +9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6.10 | Fixed | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6.10 | Fixed | RHSA-2021:4702 |
Not affected: 4 products
- Red Hat Ansible Automation Platform 1.2
- Red Hat Ansible Tower 3
- Red Hat Satellite 6.10
- Red Hat Satellite Capsule 6.10
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21330
- 2026-10-03 Alias added: GHSA-v6wp-4m6f-gcjg
References
Advisory 8
Other 7
- https://github.com/aio-libs/aiohttp
- https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2021-76.yaml
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5
- https://pypi.org/project/aiohttp
More aio-libs vulnerabilities
- TI-2025-38826 aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server CVSS 4.0HIGH 8.2
- TI-2024-15436 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal CVSS 3.1HIGH 7.5
- TI-2023-25769 Request smuggling in aiohttp CVSS 3.1HIGH 7.5
- TI-2023-18906 aiohttp vulnerable to HTTP request smuggling CVSS 3.1HIGH 7.5
- TI-2023-26746 aiohttp's ClientSession is vulnerable to CRLF injection via version CVSS 3.1HIGH 7.2
- TI-2026-66145 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-21330 · CVE Program
- CVE-2021-21330 · NVD
- FIRST EPSS
- GHSA-v6wp-4m6f-gcjg · GitHub Advisory Database · CC BY 4.0
- CVE-2021-21330 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences