Aio-libs Aiohttp vulnerabilities

• aio-libs aiohttp AIOHTTP: Pure-Python parser request smuggling CVE-2026-111750 Fix available 6.3 MediumOctober 19, 2026
• aio-libs aiohttp AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies CVE-2026-111749 Fix available 2.3 LowOctober 19, 2026
• aio-libs aiohttp AIOHTTP: Absolute-form request targets can spoof Request.scheme CVE-2026-111748 Fix available 6.3 MediumOctober 19, 2026
• aio-libs aiohttp AIOHTTP: File descriptor exhaustion in multipart requests CVE-2026-111066 Fix available 8.2 HighOctober 19, 2026
• aio-libs aiohttp AIOHTTP: Connector pool exhaustion via Max-Age overflow CVE-2026-111065 Fix available 6.9 MediumOctober 19, 2026
• aio-libs aiohttp aiohttp server lacks an initial request/header timeout CVE-2026-111064 Fix available 8.2 HighOctober 19, 2026
• aio-libs aiohttp AIOHTTP: Secure attribute not enforced for shared cookie CVE-2026-111063 Fix available 6.3 MediumOctober 19, 2026
• aio-libs aiohttp AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) CVE-2026-69244 Fix available 7.1 HighAugust 3, 2026
• aio-libs aiohttp AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate CVE-2026-59881 Fix available 6.9 MediumJuly 30, 2026
• aio-libs aiohttp AIOHTTP: Incomplete websocket frame payloads bypass memory limits CVE-2026-54274 Fix available 6.6 MediumJune 15, 2026
• aio-libs aiohttp AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections CVE-2026-54275 Fix available 2.7 LowJune 15, 2026
• aio-libs aiohttp AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect CVE-2026-54280 Fix available 1.7 LowJune 15, 2026
• aio-libs aiohttp AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit CVE-2026-54273 Fix available 6.6 MediumJune 15, 2026
• aio-libs aiohttp AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup CVE-2026-54278 Fix available 6.6 MediumJune 15, 2026
• aio-libs aiohttp AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines CVE-2026-54277 Fix available 6.6 MediumJune 15, 2026
• aio-libs aiohttp AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges CVE-2026-54276 Fix available 6.3 MediumJune 15, 2026
• aio-libs aiohttp AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence CVE-2026-54279 Fix available 1.3 LowJune 15, 2026
• aio-libs aiohttp AIOHTTP: CRLF injection in multipart headers CVE-2026-50269 Fix available 2.7 LowJune 15, 2026
• aio-libs aiohttp AIOHTTP vulnerable to cross-origin redirect with per-request cookies CVE-2026-47265 Fix available 6.6 MediumJune 2, 2026
• aio-libs aiohttp, red hat exploit intelligence, lightspeed core +27 more +29 more AIOHTTP Vulnerable to Deserialization of Untrusted Data CVE-2026-34993 Fix available 6.4 MediumJune 2, 2026
• aio-libs aiohttp AIOHTTP: Duplicate Host header accepted CVE-2026-34525 Fix available 6.3 MediumApril 1, 2026
• aio-libs aiohttp AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass CVE-2026-34520 Fix available 2.7 LowApril 1, 2026
• aio-libs aiohttp AIOHTTP: HTTP response splitting via \r in reason phrase CVE-2026-34519 Fix available 2.7 LowApril 1, 2026
• aio-libs aiohttp AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect CVE-2026-34518 Fix available 2.7 LowApril 1, 2026
• aio-libs aiohttp AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS CVE-2026-34517 Fix available 2.7 LowApril 1, 2026
• aio-libs aiohttp AIOHTTP: Multipart Header Size Bypass CVE-2026-34516 Fix available 6.6 MediumApril 1, 2026
• aio-libs aiohttp AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows CVE-2026-34515 Fix available 6.6 MediumApril 1, 2026
• aio-libs aiohttp AIOHTTP: CRLF injection in multipart part content type header construction CVE-2026-34514 Fix available 2.7 LowApril 1, 2026
• aio-libs aiohttp AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector CVE-2026-34513 Fix available 2.7 LowApril 1, 2026
• aio-libs aiohttp AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers CVE-2026-22815 Fix available 6.9 MediumApril 1, 2026
• aio-libs aiohttp AIOHTTP Vulnerable to Cookie Parser Warning Storm CVE-2025-69230 Fix available 2.7 LowJanuary 5, 2026
• aio-libs aiohttp AIOHTTP vulnerable to DoS through chunked messages CVE-2025-69229 Fix available 6.6 MediumJanuary 5, 2026
• aio-libs aiohttp AIOHTTP vulnerable to denial of service through large payloads CVE-2025-69228 Fix available 6.6 MediumJanuary 5, 2026
• aio-libs aiohttp AIOHTTP vulnerable to DoS when bypassing asserts CVE-2025-69227 Fix available 6.6 MediumJanuary 5, 2026
• aio-libs aiohttp AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields CVE-2025-69225 Fix available 2.7 LowJanuary 5, 2026
• aio-libs aiohttp AIOHTTP allows for a brute-force leak of internal static filepath components CVE-2025-69226 Fix available 6.3 MediumJanuary 5, 2026
• aio-libs aiohttp AIOHTTP's Unicode processing of header values could cause parsing discrepancies CVE-2025-69224 Fix available 6.3 MediumJanuary 5, 2026
• aio-libs aiohttp, red hat openshift lightspeed, openshift service mesh 2 +18 more +20 more AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb CVE-2025-69223 Fix available 7.5 HighJanuary 5, 2026
• aio-libs aiohttp AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections CVE-2025-53643 Fix available 1.7 LowJuly 14, 2025
• aio-libs aiohttp aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions CVE-2024-52304 Fix available 6.3 MediumNovember 18, 2024
• aio-libs aiohttp, aiohttp aio-libs +1 more aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method CVE-2024-52303 Fix available 8.7 HighNovember 18, 2024
• aio-libs aiohttp In aiohttp, compressed files as symlinks are not protected from path traversal CVE-2024-42367 Fix available 4.8 MediumAugust 9, 2024
• aio-libs aiohttp Denial of service when trying to parse malformed POST requests in aiohttp CVE-2024-30251 Fix available 7.5 HighMay 2, 2024
• aio-libs aiohttp, fedoraproject fedora +1 more aiohttp vulnerable to XSS on index pages for static file handling CVE-2024-27306 Fix available 6.1 MediumApril 18, 2024
• aio-libs aiohttp, fedoraproject fedora +1 more aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal CVE-2024-23334 Public exploitFix available EPSS 76.9% 5.9 MediumJanuary 29, 2024
• aio-libs aiohttp, fedoraproject fedora +1 more aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators CVE-2024-23829 Fix available 6.5 MediumJanuary 29, 2024
• aio-libs aiohttp aiohttp's ClientSession is vulnerable to CRLF injection via version CVE-2023-49081 Fix available 7.2 HighNovember 27, 2023
• aio-libs aiohttp aiohttp's ClientSession is vulnerable to CRLF injection via method CVE-2023-49082 Fix available 5.3 MediumNovember 27, 2023
• aio-libs aiohttp AIOHTTP: HTTP request smuggling via WebSocket upgrade CVE-2026-69243 Public exploitFix available 6.3 MediumNovember 27, 2023
• aio-libs aiohttp Request smuggling in aiohttp CVE-2023-47627 Fix available 5.3 MediumNovember 14, 2023
• Show olderLoading…