Vulnerabilities

TI-2026-39173 CVE-2026-54273 · GHSA-4fvr-rgm6-gqmc

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00493 Published 2026-06-22 Partial fix · 3.14.1 CWE-770

TI-2026-39180 CVE-2026-54280 · GHSA-9x8q-7h8h-wcw9

AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

LOW 10

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.0046 Published 2026-06-22 Partial fix · 3.14.1 CWE-404

TI-2026-39178 CVE-2026-54278 · GHSA-g3cq-j2xw-wf74

AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00493 Published 2026-06-22 Partial fix · 3.14.1 CWE-409

TI-2026-39177 CVE-2026-54277 · GHSA-63hw-fmq6-xxg2

AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00563 Published 2026-06-22 Partial fix · 3.14.1 CWE-770

TI-2026-39176 CVE-2026-54276 · GHSA-hpj7-wq8m-9hgp

AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

LOW 28

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00307 Published 2026-06-22 Partial fix · 3.14.1 CWE-200

TI-2026-39175 CVE-2026-54275 · GHSA-4m7w-qmgq-4wj5

AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

LOW 14

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.0047 Published 2026-06-22 Partial fix · 3.14.1 CWE-297

TI-2026-39174 CVE-2026-54274 · GHSA-xcgm-r5h9-7989

AIOHTTP: Incomplete websocket frame payloads bypass memory limits

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00539 Published 2026-06-22 Partial fix · 3.14.1 CWE-770

TI-2026-39179 CVE-2026-54279 · GHSA-2fqr-mr3j-6wp8

AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

LOW 9

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 1.3 Network No auth User interaction EPSS 0.00493 Published 2026-06-22 Fixed in 3.14.1 CWE-665

TI-2026-37012 CVE-2026-50269 · GHSA-m6qw-4cw2-hm4m

AIOHTTP: CRLF injection in multipart headers

LOW 20

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00533 Published 2026-06-22 Partial fix · 3.14.0 CWE-113

TI-2026-34845 CVE-2026-47265 · GHSA-hg6j-4rv6-33pg

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

LOW 34

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.0015 Published 2026-06-02 Partial fix · 3.14.0 CWE-346

TI-2026-27214 CVE-2026-34993 · GHSA-jg22-mg44-37j8

AIOHTTP Vulnerable to Deserialization of Untrusted Data

LOW 31

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00179 Published 2026-06-02 Partial fix · 3.14.0 CWE-502

TI-2026-26774 CVE-2026-34525 · GHSA-c427-h43c-vf67

AIOHTTP: Duplicate Host header accepted

LOW 28

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00299 Published 2026-04-01 Partial fix · 3.13.4 CWE-20

TI-2026-26770 CVE-2026-34520 · GHSA-63hf-3vf5-4wqf

HTTP response splitting in aio-libs aiohttp

LOW 20

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00479 Published 2026-04-01 Partial fix · 3.13.4 CWE-113

TI-2026-26769 CVE-2026-34519 · GHSA-mwh4-6h8g-pg8w

AIOHTTP: HTTP response splitting via \r in reason phrase

LOW 13

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00304 Published 2026-04-01 Partial fix · 3.13.4 CWE-113

TI-2026-26768 CVE-2026-34518 · GHSA-966j-vmvw-g2g9

AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

LOW 20

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.0035 Published 2026-04-01 Partial fix · 3.13.4 CWE-200

TI-2026-26767 CVE-2026-34517 · GHSA-3wq7-rqq7-wx6j

AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS

LOW 20

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00399 Published 2026-04-01 Partial fix · 3.13.4 CWE-770

TI-2026-26766 CVE-2026-34516 · GHSA-m5qp-6w8w-w647

AIOHTTP: Multipart Header Size Bypass

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00457 Published 2026-04-01 Partial fix · 3.13.4 CWE-770

TI-2026-26765 CVE-2026-34515 · GHSA-p998-jp59-783m

AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.0045 Published 2026-04-01 Fixed in 3.13.4 CWE-36

TI-2026-26764 CVE-2026-34514 · GHSA-2vrm-gr82-f7m5

AIOHTTP: CRLF injection in multipart part content type header construction

LOW 20

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00327 Published 2026-04-01 Partial fix · 3.13.4 CWE-113

TI-2026-18331 CVE-2026-22815 · GHSA-w2fm-2cpv-w7v5

AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

LOW 37

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00457 Published 2026-04-01 Partial fix · 3.13.4 CWE-400

TI-2026-26763 CVE-2026-34513 · GHSA-hcc4-c3v8-rx92

AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

LOW 20

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00457 Published 2026-04-01 Partial fix · 3.13.4 CWE-770

TI-2025-42684 CVE-2025-69230 · GHSA-fh55-r93g-j68g

AIOHTTP Vulnerable to Cookie Parser Warning Storm

LOW 20

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00364 Published 2026-01-05 Partial fix · 3.13.3 CWE-779

TI-2025-42683 CVE-2025-69229 · GHSA-g84x-mcqj-x9qq

AIOHTTP vulnerable to DoS through chunked messages

LOW 35

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00404 Published 2026-01-05 Partial fix · 3.13.3 CWE-770

TI-2025-42682 CVE-2025-69228 · GHSA-6jhg-hg63-jvvf

AIOHTTP vulnerable to denial of service through large payloads

LOW 35

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00407 Published 2026-01-05 Partial fix · 3.13.3 CWE-770

TI-2025-42681 CVE-2025-69227 · GHSA-jj3x-wxrx-4x23

AIOHTTP vulnerable to DoS when bypassing asserts

LOW 35

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00396 Published 2026-01-05 Partial fix · 3.13.3 CWE-835

Vulnerabilities

Filters