Request smuggling in aiohttp
Priority HIGH 72CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00857 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed aiohttp (aio-libs): 3.8.6aiohttp (PyPI): 3.8.6Red Hat: 5 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aio-libs | aiohttp | before 3.8.6 | 3.8.6 | Patch available | CNA |
| — | aiohttp (PyPI) | before 3.8.6 | 3.8.6 | Patch available | GHSA-gfw2-4jvh-wgfg |
- aiohttp Vendoraio-libs Affected before 3.8.6 Fixed in 3.8.6 Patch available CNA
- aiohttp (PyPI) Vendor— Affected before 3.8.6 Fixed in 3.8.6 Patch available GHSA-gfw2-4jvh-wgfg
Remediation
- Fix · CNA aiohttp (aio-libs) Fixed in 3.8.6
- Fix · GHSA-gfw2-4jvh-wgfg aiohttp (PyPI) Fixed in 3.8.6 Advisory →
Red Hat 5 advisories
- RHSA-2024:2010 Released 2024-04-23 · Red Hat rating ImportantSatellite 6.15.0 release
- Red Hat Satellite 6.15 for RHEL 8 foreman-3.9.1.6-1.el8sat, foreman-cli-3.9.1.6-1.el8sat, foreman-debug-3.9.1.6-1.el8sat +28
- RHSA-2024:1878 Released 2024-04-18 · Red Hat rating ModerateRHUI 4.8 Release - Security Updates, Bug Fixes, and Enhancements
- RHUI 4 for RHEL 8 python-aiohttp-3.9.2-1.el8ui, python-cryptography-41.0.6-1.el8ui, python-django-4.2.11-1.el8ui +7
- RHSA-2024:1640 Released 2024-04-02 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.5-2.el8ap, python39-aiohttp-3.9.3-1.el8ap, python39-django-4.2.11-1.el8ap +4
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.5-2.el9ap, python-aiohttp-3.9.3-1.el9ap, python-django-4.2.11-1.el9ap +4
Show 2 more Red Hat advisories
- RHSA-2024:1536 Released 2024-03-27 · Red Hat rating ModerateSatellite 6.14.3 Async Security Update
- Red Hat Satellite 6.14 for RHEL 8 python-aiohttp-3.9.2-0.1.el8pc, python-django-3.2.22-1.el8pc, python-galaxy-importer-0.4.18-2.el8pc +5
- RHSA-2024:1057 Released 2024-02-29 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-automation-platform-installer-2.4-6.el8ap, ansible-rulebook-1.0.5-1.el8ap, automation-eda-controller-1.0.5-1.el8ap +14
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-automation-platform-installer-2.4-6.el9ap, ansible-rulebook-1.0.5-1.el9ap, automation-eda-controller-1.0.5-1.el9ap +14
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| RHUI 4 for RHEL 8 | Fixed | RHSA-2024:1878 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:1057, RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:1057, RHSA-2024:1640 |
| Red Hat Satellite 6.14 for RHEL 8 | Fixed | RHSA-2024:1536 |
| Red Hat Satellite 6.15 for RHEL 8 | Fixed | RHSA-2024:2010 |
Not affected: 7 products
- RHUI 4 for RHEL 8
- Red Hat Ansible Automation Platform 1.2
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Satellite 6.14 for RHEL 8
- Red Hat Satellite 6.15 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-47627
- 2026-10-03 Alias added: GHSA-gfw2-4jvh-wgfg
References
Other 10
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VDKQ6HM3KNDU4OQI476ZWT4O7DMSIT35/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WQYQL6WV535EEKSNH7KRARLLMOW5WXDM/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FUSJVQ7OQ55RWL4XAX2F5EZ73N4ZSH6U/
- https://github.com/aio-libs/aiohttp
- https://github.com/aio-libs/aiohttp/releases/tag/v3.8.6
- https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-246.yaml
- https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FUSJVQ7OQ55RWL4XAX2F5EZ73N4ZSH6U
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VDKQ6HM3KNDU4OQI476ZWT4O7DMSIT35
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WQYQL6WV535EEKSNH7KRARLLMOW5WXDM
More aio-libs vulnerabilities
- TI-2025-38826 aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server CVSS 4.0HIGH 8.2
- TI-2024-15436 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal CVSS 3.1HIGH 7.5
- TI-2023-18906 aiohttp vulnerable to HTTP request smuggling CVSS 3.1HIGH 7.5
- TI-2023-26746 aiohttp's ClientSession is vulnerable to CRLF injection via version CVSS 3.1HIGH 7.2
- TI-2026-66145 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction CVSS 3.1MEDIUM 5.3
- TI-2023-26747 aiohttp's ClientSession is vulnerable to CRLF injection via method CVSS 3.1MEDIUM 5.3
Sources
- CVE-2023-47627 · CVE Program
- CVE-2023-47627 · NVD
- FIRST EPSS
- GHSA-gfw2-4jvh-wgfg · GitHub Advisory Database · CC BY 4.0
- CVE-2023-47627 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences