Vulnerabilities

TI-2026-76532 CVE-2026-111750 · GHSA-pqxq-w44r-73xw

Request smuggling in aiohttp pure-Python HTTP parser

LOW 34

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00382 Published 2026-10-19 Partial fix · 3.14.4 CWE-444

TI-2026-76531 CVE-2026-111749 · GHSA-gx76-c99x-2c96

Subdomain cookies can strip Host-Only scope in AIOHTTP

LOW 20

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00384 Published 2026-10-19 Partial fix · 3.14.4 CWE-565

TI-2026-76530 CVE-2026-111748 · GHSA-f9xw-jh8m-3mwq

Absolute-form request targets can spoof Request.scheme in AIOHTTP

LOW 28

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00386 Published 2026-10-19 Partial fix · 3.14.4 CWE-807

TI-2026-76529 CVE-2026-111066 · GHSA-9xw5-w5jj-pvcg

File descriptor exhaustion in AIOHTTP multipart request processing

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00412 Published 2026-10-19 Partial fix · 3.14.4 CWE-400

TI-2026-76528 CVE-2026-111065 · GHSA-6cjc-53gc-5rqm

Connector pool exhaustion in AIOHTTP via Max-Age overflow

LOW 37

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00395 Published 2026-10-19 Partial fix · 3.14.4 CWE-770

TI-2026-76527 CVE-2026-111064 · GHSA-5wr8-gcqf-gqf3

Missing initial request timeout in aiohttp server

MEDIUM 42

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00399 Published 2026-10-19 Partial fix · 3.14.4 CWE-770

TI-2026-76526 CVE-2026-111063 · GHSA-494j-54xm-rwp3

AIOHTTP does not enforce the Secure attribute on shared cookies

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00233 Published 2026-10-19 Partial fix · 3.14.4 CWE-1004

TI-2026-66145 CVE-2026-104874 · GHSA-54p9-h82j-f925

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

MEDIUM 63

Multidict is an implementation of a multidict data structure.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00448 Published 2026-10-02 Partial fix · 6.9.1 CWE-401

TI-2026-48583 CVE-2026-69244 · GHSA-cq5v-8q36-5273

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

LOW 32

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00528 Published 2026-08-03 Partial fix · 3.14.3 CWE-125

TI-2026-48582 CVE-2026-69243 · GHSA-mfx4-hv73-q22v

AIOHTTP: HTTP request smuggling via WebSocket upgrade

LOW 28

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00443 Published 2026-08-03 Partial fix · 3.14.2 CWE-444

TI-2026-42695 CVE-2026-59881 · GHSA-mq44-7p77-q5h7

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

LOW 31

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00524 Published 2026-07-30 Partial fix · 3.14.2 CWE-20

TI-2026-39173 CVE-2026-54273 · GHSA-4fvr-rgm6-gqmc

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00493 Published 2026-06-22 Partial fix · 3.14.1 CWE-770

TI-2026-39180 CVE-2026-54280 · GHSA-9x8q-7h8h-wcw9

AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

LOW 10

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.0046 Published 2026-06-22 Partial fix · 3.14.1 CWE-404

TI-2026-39178 CVE-2026-54278 · GHSA-g3cq-j2xw-wf74

AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00493 Published 2026-06-22 Partial fix · 3.14.1 CWE-409

TI-2026-39177 CVE-2026-54277 · GHSA-63hw-fmq6-xxg2

AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00563 Published 2026-06-22 Partial fix · 3.14.1 CWE-770

TI-2026-39176 CVE-2026-54276 · GHSA-hpj7-wq8m-9hgp

AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

LOW 28

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00307 Published 2026-06-22 Partial fix · 3.14.1 CWE-200

TI-2026-39175 CVE-2026-54275 · GHSA-4m7w-qmgq-4wj5

AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

LOW 14

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.0047 Published 2026-06-22 Partial fix · 3.14.1 CWE-297

TI-2026-39174 CVE-2026-54274 · GHSA-xcgm-r5h9-7989

AIOHTTP: Incomplete websocket frame payloads bypass memory limits

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00539 Published 2026-06-22 Partial fix · 3.14.1 CWE-770

TI-2026-39179 CVE-2026-54279 · GHSA-2fqr-mr3j-6wp8

AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

LOW 9

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 1.3 Network No auth User interaction EPSS 0.00493 Published 2026-06-22 Fixed in 3.14.1 CWE-665

TI-2026-37012 CVE-2026-50269 · GHSA-m6qw-4cw2-hm4m

AIOHTTP: CRLF injection in multipart headers

LOW 20

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00533 Published 2026-06-22 Partial fix · 3.14.0 CWE-113

TI-2026-34845 CVE-2026-47265 · GHSA-hg6j-4rv6-33pg

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

LOW 34

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.0015 Published 2026-06-02 Partial fix · 3.14.0 CWE-346

TI-2026-27214 CVE-2026-34993 · GHSA-jg22-mg44-37j8

AIOHTTP Vulnerable to Deserialization of Untrusted Data

LOW 31

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00179 Published 2026-06-02 Partial fix · 3.14.0 CWE-502

TI-2026-26774 CVE-2026-34525 · GHSA-c427-h43c-vf67

AIOHTTP: Duplicate Host header accepted

LOW 28

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00299 Published 2026-04-01 Partial fix · 3.13.4 CWE-20

TI-2026-26770 CVE-2026-34520 · GHSA-63hf-3vf5-4wqf

HTTP response splitting in aio-libs aiohttp

LOW 20

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00479 Published 2026-04-01 Partial fix · 3.13.4 CWE-113

TI-2026-26769 CVE-2026-34519 · GHSA-mwh4-6h8g-pg8w

AIOHTTP: HTTP response splitting via \r in reason phrase

LOW 13

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00304 Published 2026-04-01 Partial fix · 3.13.4 CWE-113

Vulnerabilities

Filters