Read the docs
TI-2024-34979 Aliases CVE-2024-52304GHSA-8495-4g3g-x7pr

aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

Priority LOW 35CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 6 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00563 47th percentileScored 2026-11-07
Fix Partial aiohttp (aio-libs): 3.10.11aiohttp (PyPI): 3.10.11Red Hat: 7 advisoriesRed Hat: 6 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
aio-libsaiohttpbefore 3.10.113.10.11Patch availableCNA
—aiohttp (PyPI)before 3.10.113.10.11Patch availableGHSA-8495-4g3g-x7pr
  • aiohttp Vendoraio-libs Affected before 3.10.11 Fixed in 3.10.11 Patch available CNA
  • aiohttp (PyPI) Vendor— Affected before 3.10.11 Fixed in 3.10.11 Patch available GHSA-8495-4g3g-x7pr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*before 3.10.11VulnerableAiohttp
  • cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* Versions before 3.10.11 Vulnerable ·Aiohttp

Remediation

  • Fix · CNA aiohttp (aio-libs) Fixed in 3.10.11
  • Fix · GHSA-8495-4g3g-x7pr aiohttp (PyPI) Fixed in 3.10.11 Advisory →

Red Hat 7 advisories

  • RHSA-2025:1101 Released 2025-02-05 · Red Hat rating Important
    Red Hat Ansible Automation Platform Execution Environments Container Release Update
    • Ansible Automation Platform Execution Environments ansible-automation-platform/ee-minimal-rhel8, ansible-automation-platform/ee-minimal-rhel9
  • RHSA-2025:0753 Released 2025-01-28 · Red Hat rating Important
    Red Hat Ansible Automation Platform Execution Environments Container Release Update
    • Ansible Automation Platform Execution Environments ansible-automation-platform/ee-minimal-rhel8, ansible-automation-platform/ee-minimal-rhel9
  • RHSA-2025:0722 Released 2025-01-27 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.4 Container Release Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-automation-platform-24/lightspeed-rhel8-operator
Show 4 more Red Hat advisories
  • RHSA-2025:0341 Released 2025-01-15 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-automation-platform-25/lightspeed-rhel8
  • RHSA-2025:0340 Released 2025-01-15 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.6-1.el8ap, automation-gateway-server-2.5.20250115-1.el8ap, python3.11-aiohttp-3.10.11-1.el8ap
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.6-1.el9ap, automation-gateway-server-2.5.20250115-1.el9ap, python3.11-aiohttp-3.10.11-1.el9ap
  • RHSA-2024:11574 Released 2024-12-19 · Red Hat rating Moderate
    Satellite 6.16.1 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 python-aiohttp-3.10.11-1.el8pc, python3.11-aiohttp-3.10.11-1.el8pc
    • Red Hat Satellite 6.16 for RHEL 9 python-aiohttp-3.10.11-1.el9pc, python3.11-aiohttp-3.10.11-1.el9pc
  • RHSA-2024:10766 Released 2024-12-03 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.3-1.el8ap, receptor-1.5.1-2.el8ap, receptorctl-1.5.1-2.el8ap
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.3-1.el9ap, receptor-1.5.1-2.el9ap, receptorctl-1.5.1-2.el9ap

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI)AffectedNo fix yet: Fix deferred
Red Hat Update Infrastructure 4 for Cloud ProvidersAffectedNo fix planned: Will not fix
Ansible Automation Platform Execution EnvironmentsFixed RHSA-2025:0753, RHSA-2025:1101
Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed RHSA-2025:0722
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2024:10766, RHSA-2025:0340, RHSA-2025:0341
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2024:10766, RHSA-2025:0340
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2024:11574
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2024:11574
Not affected: 8 products
  • Ansible Automation Platform Execution Environments
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52304
  2. 2026-10-03 Alias added: GHSA-8495-4g3g-x7pr

References

Patch 1

Advisory 2

Other 2

  • TI-2025-38826 aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server CVSS 4.0HIGH 8.2
  • TI-2024-15436 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal CVSS 3.1HIGH 7.5
  • TI-2023-25769 Request smuggling in aiohttp CVSS 3.1HIGH 7.5
  • TI-2023-18906 aiohttp vulnerable to HTTP request smuggling CVSS 3.1HIGH 7.5
  • TI-2023-26746 aiohttp's ClientSession is vulnerable to CRLF injection via version CVSS 3.1HIGH 7.2
  • TI-2026-66145 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction CVSS 3.1MEDIUM 5.3
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences