{"id":"CVE-2024-52304","aliases":["AZL-53229","AZL-53232","CLSA-2025-1754007189","CLSA-2026-1773620206","CLSA-2026-1787906503","CLSA-2026-1788792738","DEBIAN-CVE-2024-52304","DLA-4041-1","DSA-5828-1","EUVD-2024-3218","GHSA-8495-4g3g-x7pr","GHSA-pjjw-qhg8-p2p9","MGASA-2024-0388","OESA-2025-1045","OESA-2025-1046","OESA-2025-1047","OESA-2025-1048","PYSEC-2026-1103","RHSA-2024:10766","RHSA-2024:11574","RHSA-2025:0340","SUSE-SU-2024:4077-1","SUSE-SU-2024:4110-1","UBUNTU-CVE-2024-52304","USN-7642-1"],"status":"published","title":"aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00563,"percentile":0.47167,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2024-11-18T20:12:48Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"PyPI","package":"aiohttp","fixed_in":["3.10.11"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:PyPI","package":"aiohttp","fixed_in":["3.8.5.post2+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-aiohttp","fixed_in":["3.8.4-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-aiohttp","fixed_in":["3.10.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-aiohttp","fixed_in":["3.10.11-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-aiohttp","fixed_in":["3.7.4-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-aiohttp","fixed_in":["3.7.4-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-aiohttp","fixed_in":["3.9.3-6.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-aiohttp","fixed_in":["3.7.4-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-aiohttp","fixed_in":["0:3.10.11-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-aiohttp-debugsource","fixed_in":["0:3.10.11-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-aiohttp","fixed_in":["0:3.10.11-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-aiohttp-debuginfo","fixed_in":["0:3.10.11-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el8","package":"python-aiohttp","fixed_in":["0:3.10.11-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el8","package":"python-aiohttp-debugsource","fixed_in":["0:3.10.11-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-aiohttp","fixed_in":["0:3.10.11-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-aiohttp-debuginfo","fixed_in":["0:3.10.11-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-aiohttp","fixed_in":["0:3.10.11-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-aiohttp-debugsource","fixed_in":["0:3.10.11-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-aiohttp","fixed_in":["0:3.10.11-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-aiohttp-debuginfo","fixed_in":["0:3.10.11-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el9","package":"python-aiohttp","fixed_in":["0:3.10.11-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el9","package":"python-aiohttp-debugsource","fixed_in":["0:3.10.11-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-aiohttp","fixed_in":["0:3.10.11-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-aiohttp-debuginfo","fixed_in":["0:3.10.11-1.el9pc"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-aiohttp","fixed_in":["3.9.3-150400.10.27.1","3.6.0-150100.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-aiohttp","fixed_in":["3.9.3-150400.10.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-aiohttp","fixed_in":["3.9.3-150400.10.27.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-aiohttp","fixed_in":["3.9.3-150400.10.27.1","3.6.0-150100.3.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-aiohttp","fixed_in":["3.9.3-150400.10.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"python-aiohttp","fixed_in":["3.6.0-150100.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"python-aiohttp","fixed_in":["3.6.0-150100.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"python-aiohttp","fixed_in":["3.6.0-150100.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"python-aiohttp","fixed_in":["3.6.0-150100.3.18.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-aiohttp","fixed_in":["3.0.1-1ubuntu0.1~esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-aiohttp","fixed_in":["3.8.1-4ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-aiohttp","fixed_in":["3.9.1-1ubuntu0.1+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.10.10"},{"fixed":"3.10.11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.2-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.2-3"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.5"},{"fixed":"3.8.5.post2+tuxcare"}]}],"versions":["3.8.5","3.8.5.post1+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.1"},{"fixed":"3.8.1.post7+tuxcare"}]}],"versions":["3.8.1","3.8.1.post1+tuxcare","3.8.1.post2+tuxcare","3.8.1.post3+tuxcare","3.8.1.post4+tuxcare","3.8.1.post5+tuxcare","3.8.1.post6+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.6"},{"fixed":"3.8.6.post10+tuxcare"}]}],"versions":["3.8.6","3.8.6.post1+tuxcare","3.8.6.post2+tuxcare","3.8.6.post3+tuxcare","3.8.6.post4+tuxcare","3.8.6.post5+tuxcare","3.8.6.post6+tuxcare","3.8.6.post7+tuxcare","3.8.6.post8+tuxcare","3.8.6.post9+tuxcare"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.4"},{"fixed":"3.8.4.post8+tuxcare"}]}],"versions":["3.8.4","3.8.4.post1+tuxcare","3.8.4.post2+tuxcare","3.8.4.post3+tuxcare","3.8.4.post4+tuxcare","3.8.4.post5+tuxcare","3.8.4.post6+tuxcare","3.8.4.post7+tuxcare"],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1+deb12u1"}]}],"versions":["3.8.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.11-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-1+deb11u1"}]}],"versions":["3.7.4-1"],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1+deb12u1"}]}],"versions":["3.8.4-1"],"bundled":6},{"source":"osv","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.11"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.16.6","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.2","0.20.0","0.20.1","0.20.2","0.21.0","0.21.1","0.21.2","0.21.4","0.21.5","0.21.6","0.22.0","0.22.0a0","0.22.0b0","0.22.0b1","0.22.0b2","0.22.0b3","0.22.0b4","0.22.0b5","0.22.0b6","0.22.1","0.22.2","0.22.3","0.22.4","0.22.5","0.3","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.5","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","2.0.0","2.0.0rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.0a1","2.3.0a2","2.3.0a3","2.3.0a4","2.3.1","2.3.10","2.3.1a1","2.3.2","2.3.2b2","2.3.2b3","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","3.0.0","3.0.0b0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.0b1","3.10.0rc0","3.10.1","3.10.10","3.10.11rc0","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.6rc0","3.10.6rc1","3.10.6rc2","3.10.7","3.10.8","3.10.9","3.2.0","3.2.1","3.3.0","3.3.0a0","3.3.1","3.3.2","3.3.2a0","3.4.0","3.4.0a0","3.4.0a3","3.4.0b1","3.4.0b2","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.0a1","3.5.0b1","3.5.0b2","3.5.0b3","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0a0","3.6.0a1","3.6.0a11","3.6.0a12","3.6.0a2","3.6.0a3","3.6.0a4","3.6.0a5","3.6.0a6","3.6.0a7","3.6.0a8","3.6.0a9","3.6.0b0","3.6.1","3.6.1b3","3.6.1b4","3.6.2","3.6.2a0","3.6.2a1","3.6.2a2","3.6.3","3.7.0","3.7.0b0","3.7.0b1","3.7.1","3.7.2","3.7.3","3.7.4","3.7.4.post0","3.8.0","3.8.0a7","3.8.0b0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.9.0","3.9.0b0","3.9.0b1","3.9.0rc0","3.9.1","3.9.2","3.9.3","3.9.4","3.9.4rc0","3.9.5"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3-3.2.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-6.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.11"}]}],"versions":["0.1","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.16.6","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.2","0.20.0","0.20.1","0.20.2","0.21.0","0.21.1","0.21.2","0.21.4","0.21.5","0.21.6","0.22.0","0.22.0a0","0.22.0b0","0.22.0b1","0.22.0b2","0.22.0b3","0.22.0b4","0.22.0b5","0.22.0b6","0.22.1","0.22.2","0.22.3","0.22.4","0.22.5","0.3","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.5","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","2.0.0","2.0.0rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.0a1","2.3.0a2","2.3.0a3","2.3.0a4","2.3.1","2.3.10","2.3.1a1","2.3.2","2.3.2b2","2.3.2b3","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","3.0.0","3.0.0b0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.0b1","3.10.0rc0","3.10.1","3.10.10","3.10.11rc0","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.6rc0","3.10.6rc1","3.10.6rc2","3.10.7","3.10.8","3.10.9","3.2.0","3.2.1","3.3.0","3.3.0a0","3.3.1","3.3.2","3.3.2a0","3.4.0","3.4.0a0","3.4.0a3","3.4.0b1","3.4.0b2","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.0a1","3.5.0b1","3.5.0b2","3.5.0b3","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0a0","3.6.0a1","3.6.0a11","3.6.0a12","3.6.0a2","3.6.0a3","3.6.0a4","3.6.0a5","3.6.0a6","3.6.0a7","3.6.0a8","3.6.0a9","3.6.0b0","3.6.1","3.6.1b3","3.6.1b4","3.6.2","3.6.2a0","3.6.2a1","3.6.2a2","3.6.3","3.7.0","3.7.0b0","3.7.0b1","3.7.1","3.7.2","3.7.3","3.7.4","3.7.4.post0","3.8.0","3.8.0a7","3.8.0b0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.9.0","3.9.0b0","3.9.0b1","3.9.0rc0","3.9.1","3.9.2","3.9.3","3.9.4","3.9.4rc0","3.9.5"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.3-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.3-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-2.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.6-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.6-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.11-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.11-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20250115-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20250115-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.27.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.27.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-150400.10.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-150100.3.18.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1ubuntu0.1~esm5"}]}],"versions":["2.2.3-1build1","2.2.3-2","2.3.6-1","3.0.1-1","3.0.1-1ubuntu0.1~esm1","3.0.1-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-4ubuntu0.2+esm1"}]}],"versions":["3.7.4-1","3.7.4-1build2","3.8.1-3","3.8.1-4","3.8.1-4build1","3.8.1-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-1ubuntu0.1+esm1"}]}],"versions":["3.8.4-1","3.9.1-1","3.9.1-1build1","3.9.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1ubuntu0.1~esm5"}]}],"versions":["2.2.3-1build1","2.2.3-2","2.3.6-1","3.0.1-1","3.0.1-1ubuntu0.1~esm1","3.0.1-1ubuntu0.1~esm4"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1ubuntu1+esm4"}]}],"versions":["3.5.4-1","3.5.4-1build1","3.6.1-1","3.6.2-1","3.6.2-1build1","3.6.2-1ubuntu0.1~esm1","3.6.2-1ubuntu1","3.6.2-1ubuntu1+esm1","3.6.2-1ubuntu1+esm3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-4ubuntu0.2+esm1"}]}],"versions":["3.7.4-1","3.7.4-1build2","3.8.1-3","3.8.1-4","3.8.1-4build1","3.8.1-4ubuntu0.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-1ubuntu0.1+esm1"}]}],"versions":["3.8.4-1","3.9.1-1","3.9.1-1build1","3.9.1-1ubuntu0.1"],"bundled":7}],"products":[{"vendor":"aio-libs","product":"aiohttp"},{"vendor":"aiohttp","product":"aiohttp"},{"vendor":"python","product":"aiohttp"}],"references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52304","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8495-4g3g-x7pr","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52304.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-52304","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0388.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33544","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6991-1","tags":["advisory"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2024-November/019855.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1045","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1046","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1047","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1048","tags":["advisory"]},{"url":"https://pypi.org/project/aiohttp","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10766","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2327130","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10766.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52304","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52304","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-53259","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329991","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53259","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53259","tags":["advisory"]},{"url":"https://github.com/quic-go/quic-go/commit/ca31dd355cbe5fc6c5807992d9d1149c66c96a50","tags":["article"]},{"url":"https://github.com/quic-go/quic-go/pull/4729","tags":["article"]},{"url":"https://github.com/quic-go/quic-go/releases/tag/v0.48.2","tags":["article"]},{"url":"https://github.com/quic-go/quic-go/security/advisories/GHSA-px8v-pp82-rcvr","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11574","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.16/html/updating_red_hat_satellite/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28560","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28990","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29255","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29340","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29427","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29432","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29697","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29698","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29699","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29700","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29701","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29702","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29946","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29947","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-29974","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30085","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11574.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0340","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331063","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0340.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-11407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11407","tags":["advisory"]},{"url":"https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-53907","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53907","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/dec/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-53908","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53908","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-55565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-55565","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55565","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/compare/3.3.7...3.3.8","tags":["article"]},{"url":"https://github.com/ai/nanoid/pull/510","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.0.9","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244077-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233447","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52304","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244110-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-52304","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7642-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-47627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-49081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-49082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-23829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-30251","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-52304","title":"aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.","status":"published","published":"2024-11-18T20:12:48.612Z","modified":"2025-11-03T20:45:25.646Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:34:03.661584Z"}],"euvd":[{"id":"EUVD-2024-3218","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.","status":"published","published":"2024-11-18T20:12:48Z","modified":"2025-11-03T20:45:25Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:32.126029Z"}],"ghsa":[{"id":"GHSA-8495-4g3g-x7pr","title":"aiohttp allows request smuggling due to incorrect parsing of chunk extensions","description":"### Summary\nThe Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71","status":"published","published":"2024-11-18T21:02:32Z","modified":"2025-11-03T22:50:16Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2024-52304","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.","status":"published","published":"2024-11-18T21:15:06.5Z","modified":"2026-06-17T08:06:58.633Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:10:37.632431Z"}],"osv":[{"id":"CVE-2024-52304","title":"aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.","status":"published","published":"2024-11-18T20:12:48.612Z","modified":"2026-10-28T02:31:01.595643708Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"DEBIAN-CVE-2024-52304","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.","status":"published","published":"2024-11-18T21:15:06.5Z","modified":"2026-11-02T12:02:55.998111727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"GHSA-8495-4g3g-x7pr","title":"aiohttp allows request smuggling due to incorrect parsing of chunk extensions","description":"### Summary\nThe Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71","status":"published","published":"2024-11-18T21:02:32Z","modified":"2026-09-10T03:50:20.487002605Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"OESA-2025-1045","title":"python-aiohttp security update","description":"Async http client/server framework (asyncio).\r\n\r\nSecurity Fix(es):\r\n\r\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.(CVE-2024-52304)","status":"published","published":"2025-01-17T11:08:08Z","modified":"2026-08-18T01:18:40.236149032Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1046","title":"python-aiohttp security update","description":"Async http client/server framework (asyncio).\r\n\r\nSecurity Fix(es):\r\n\r\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.(CVE-2024-52304)","status":"published","published":"2025-01-17T11:08:08Z","modified":"2026-08-18T01:17:42.616283233Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1047","title":"python-aiohttp security update","description":"Async http client/server framework (asyncio).\r\n\r\nSecurity Fix(es):\r\n\r\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.(CVE-2024-52304)","status":"published","published":"2025-01-17T11:08:08Z","modified":"2026-08-18T01:17:42.577026559Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1048","title":"python-aiohttp security update","description":"Async http client/server framework (asyncio).\r\n\r\nSecurity Fix(es):\r\n\r\naiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.(CVE-2024-52304)","status":"published","published":"2025-01-17T11:08:08Z","modified":"2026-08-18T01:17:42.840613183Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"PYSEC-2026-1103","title":"aiohttp allows request smuggling due to incorrect parsing of chunk extensions","description":"### Summary\nThe Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71","status":"published","published":"2026-07-07T14:34:45.226773Z","modified":"2026-07-07T17:46:25.745431925Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"RHSA-2024:10766","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2024-12-04T10:02:19Z","modified":"2026-10-16T10:03:49Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:11574","title":"Red Hat Security Advisory: Satellite 6.16.1 Async Update","status":"published","published":"2024-12-20T10:02:32Z","modified":"2026-10-16T10:03:57Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2025:0340","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2025-01-16T10:02:24Z","modified":"2026-10-16T10:05:57Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"UBUNTU-CVE-2024-52304","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.","status":"published","published":"2024-11-18T21:15:00Z","modified":"2026-02-04T04:40:29.855824Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"AZL-53229","title":"CVE-2024-52304 affecting package python-aiohttp 3.6.2-3","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.","status":"published","published":"2024-11-18T21:15:06Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.828909Z"},{"id":"AZL-53232","title":"CVE-2024-52304 affecting package python-aiohttp 3.6.2-3","description":"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.","status":"published","published":"2024-11-18T21:15:06Z","modified":"2026-04-21T04:33:38.386468Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"CLSA-2025-1754007189","title":"TuxCare security update for aiohttp (1 CVE)","description":"TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.5.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:48:05.061184047Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2026-1773620206","title":"TuxCare security update for aiohttp (3 CVEs)","description":"TuxCare rebuilt aiohttp to address 3 CVEs. Fixed in 3.8.1.post7+tuxcare.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:48:04.973004694Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1787906503","title":"TuxCare security update for aiohttp (8 CVEs)","description":"TuxCare rebuilt aiohttp to address 8 CVEs. Fixed in 3.8.6.post10+tuxcare.","status":"published","published":"2026-08-28T08:41:43Z","modified":"2026-10-22T14:31:00.003231976Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788792738","title":"TuxCare security update for aiohttp (9 CVEs)","description":"TuxCare rebuilt aiohttp to address 9 CVEs. Fixed in 3.8.4.post8+tuxcare.","status":"published","published":"2026-09-07T14:52:18Z","modified":"2026-10-15T09:48:01.30390479Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"DLA-4041-1","title":"python-aiohttp - security update","status":"published","published":"2025-02-03T00:00:00Z","modified":"2026-03-09T01:20:42.144661Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5828-1","title":"python-aiohttp - security update","status":"published","published":"2024-12-11T00:00:00Z","modified":"2026-03-09T02:10:30.020137Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0388","title":"Updated python-aiohttp packages fix security vulnerabilities","description":"When using aiohttp as a web server and configuring static routes, it is\nnecessary to specify the root path for static files. Additionally, the\noption 'follow_symlinks' can be used to determine whether to follow\nsymbolic links outside the static root directory. When 'follow_symlinks'\nis set to True, there is no validation to check if reading a file is\nwithin the root directory. This can lead to directory traversal\nvulnerabilities, resulting in unauthorized access to arbitrary files on\nthe system, even when symlinks are not present. Disabling\nfollow_symlinks and using a reverse proxy are encouraged mitigations.\nCVE-2024-23334\nThe Python parser parses newlines in chunk extensions incorrectly which\ncan lead to request smuggling vulnerabilities under certain conditions.\nIf a pure Python version of aiohttp is installed (i.e. without the usual\nC extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker\nmay be able to execute a request smuggling attack to bypass certain\nfirewalls or proxy protections. CVE-2024-52304\n","status":"published","published":"2024-12-04T16:58:15Z","modified":"2026-04-16T04:42:51.825156176Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:4077-1","title":"Security update for python-aiohttp","description":"This update for python-aiohttp fixes the following issues:\n\n- CVE-2024-52304: Fixed request smuggling due to incorrect parsing of chunk extensions (bsc#1233447)\n","status":"published","published":"2024-11-27T12:52:22Z","modified":"2026-02-04T03:13:22.716104Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:4110-1","title":"Security update for python-aiohttp","description":"This update for python-aiohttp fixes the following issues:\n\n- CVE-2024-52304: Fixed request smuggling due to incorrect parsing of chunk extensions (bsc#1233447)\n","status":"published","published":"2024-11-29T08:06:23Z","modified":"2026-02-04T04:15:58.839884Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-7642-1","title":"python-aiohttp vulnerabilities","description":"Ben Kallus discovered that AIOHTTP did not correctly parse HTTP\nheaders. A remote attacker could possibly use this issue to perform\nrequest smuggling. This issue only affected Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2023-47627)\n\nIvan Novikov discovered that AIOHTTP did not properly validate certain\ninputs. A remote attacker could possibly use this issue to perform request\nsmuggling. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2023-49081, CVE-2023-49082)\n\nPaul J. Dorn discovered that AIOHTTP did not properly validate certain\ninputs. A remote attacker could possibly use this issue to perform request\nsmuggling. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and\nUbuntu 24.04 LTS. (CVE-2024-23829)\n\nTakeshi Kaneko discovered that AIOHTTP did not properly sanitize certain\ninputs. A remote attacker could possibly use this issue to perform a\ncross-site scripting (XSS) attack. (CVE-2024-27306)\n\nIt was discovered that AIOHTTP did not correctly handle certain POST\nrequests. A remote attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30251)\n\nJeppe Bonde Weikop discovered that AIOHTTP did not correctly handle\nparsing newlines in certain inputs. A remote attacker could possibly use\nthis issue to perform request smuggling. (CVE-2024-52304)","status":"published","published":"2025-07-17T05:56:58Z","modified":"2026-04-27T18:09:38.15639Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}