Skip to content
Aiohttp vulnerabilities
Newest
-
aio-libs aiohttp
AIOHTTP: Incomplete websocket frame payloads bypass memory limits
CVE-2026-54274
Fix available
6.6 Medium
-
aio-libs aiohttp
AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
CVE-2026-54275
Fix available
2.7 Low
-
aio-libs aiohttp
AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect
CVE-2026-54280
Fix available
1.7 Low
-
aio-libs aiohttp
AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
CVE-2026-54273
Fix available
6.6 Medium
-
aio-libs aiohttp
AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
CVE-2026-54278
Fix available
6.6 Medium
-
aio-libs aiohttp
AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines
CVE-2026-54277
Fix available
6.6 Medium
-
aio-libs aiohttp
AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
CVE-2026-54276
Fix available
6.3 Medium
-
aio-libs aiohttp
AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
CVE-2026-54279
Fix available
1.3 Low
-
aio-libs aiohttp
AIOHTTP: CRLF injection in multipart headers
CVE-2026-50269
Fix available
2.7 Low
-
aio-libs aiohttp
AIOHTTP vulnerable to cross-origin redirect with per-request cookies
CVE-2026-47265
Fix available
6.6 Medium
-
aio-libs aiohttp, red hat exploit intelligence, lightspeed core +27 more +29 more
AIOHTTP Vulnerable to Deserialization of Untrusted Data
CVE-2026-34993
Fix available
6.4 Medium
-
aio-libs aiohttp
AIOHTTP: Duplicate Host header accepted
CVE-2026-34525
Fix available
6.3 Medium
-
aio-libs aiohttp
AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass
CVE-2026-34520
Fix available
2.7 Low
-
aio-libs aiohttp
AIOHTTP: HTTP response splitting via \r in reason phrase
CVE-2026-34519
Fix available
2.7 Low
-
aio-libs aiohttp
AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect
CVE-2026-34518
Fix available
2.7 Low
-
aio-libs aiohttp
AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS
CVE-2026-34517
Fix available
2.7 Low
-
aio-libs aiohttp
AIOHTTP: Multipart Header Size Bypass
CVE-2026-34516
Fix available
6.6 Medium
-
aio-libs aiohttp
AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
CVE-2026-34515
Fix available
6.6 Medium
-
aio-libs aiohttp
AIOHTTP: CRLF injection in multipart part content type header construction
CVE-2026-34514
Fix available
2.7 Low
-
aio-libs aiohttp
AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector
CVE-2026-34513
Fix available
2.7 Low
-
aio-libs aiohttp
AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers
CVE-2026-22815
Fix available
6.9 Medium
-
aio-libs aiohttp
AIOHTTP Vulnerable to Cookie Parser Warning Storm
CVE-2025-69230
Fix available
2.7 Low
-
aio-libs aiohttp
AIOHTTP vulnerable to DoS through chunked messages
CVE-2025-69229
Fix available
6.6 Medium
-
aio-libs aiohttp
AIOHTTP vulnerable to denial of service through large payloads
CVE-2025-69228
Fix available
6.6 Medium
-
aio-libs aiohttp
AIOHTTP vulnerable to DoS when bypassing asserts
CVE-2025-69227
Fix available
6.6 Medium
-
aio-libs aiohttp
AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields
CVE-2025-69225
Fix available
2.7 Low
-
aio-libs aiohttp
AIOHTTP allows for a brute-force leak of internal static filepath components
CVE-2025-69226
Fix available
6.3 Medium
-
aio-libs aiohttp
AIOHTTP's Unicode processing of header values could cause parsing discrepancies
CVE-2025-69224
Fix available
6.3 Medium
-
aio-libs aiohttp, red hat openshift lightspeed, openshift service mesh 2 +18 more +20 more
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
CVE-2025-69223
Fix available
7.5 High
-
aio-libs aiohttp
AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections
CVE-2025-53643
Fix available
1.7 Low
-
aio-libs aiohttp
aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions
CVE-2024-52304
Fix available
6.3 Medium
-
aio-libs aiohttp, aiohttp aio-libs +1 more
aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
CVE-2024-52303
Fix available
8.7 High
-
aio-libs aiohttp
In aiohttp, compressed files as symlinks are not protected from path traversal
CVE-2024-42367
Fix available
4.8 Medium
-
aio-libs aiohttp
Denial of service when trying to parse malformed POST requests in aiohttp
CVE-2024-30251
Fix available
7.5 High
-
aio-libs aiohttp, fedoraproject fedora +1 more
aiohttp vulnerable to XSS on index pages for static file handling
CVE-2024-27306
Fix available
6.1 Medium
-
aio-libs aiohttp, fedoraproject fedora +1 more
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
CVE-2024-23334
Public exploitFix available
EPSS 76.9%
5.9 Medium
-
aio-libs aiohttp, fedoraproject fedora +1 more
aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
CVE-2024-23829
Fix available
6.5 Medium
-
aio-libs aiohttp
aiohttp's ClientSession is vulnerable to CRLF injection via version
CVE-2023-49081
Fix available
7.2 High
-
aio-libs aiohttp
aiohttp's ClientSession is vulnerable to CRLF injection via method
CVE-2023-49082
Fix available
5.3 Medium
-
aio-libs aiohttp
Request smuggling in aiohttp
CVE-2023-47627
Fix available
5.3 Medium
-
aio-libs aiohttp
Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp
CVE-2023-47641
Fix available
3.4 Low
-
aio-libs aiohttp
aiohttp vulnerable to HTTP request smuggling
CVE-2023-37276
Fix available
5.3 Medium
-
aiohttp
Withdrawn: Denial of Service in aiohttp
CVE-2022-33124
Disputed
5.5 Medium
-
aio-libs aiohttp, debian linux, fedoraproject fedora +2 more
Open redirect vulnerability in aiohttp
CVE-2021-21330
Fix available
3.1 Low