Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

aiohttp

53 known vulnerabilities (7 high, 30 medium, 16 low), with the versions each affects and the releases that fix them.

Latest release
3.14.5 (Oct 11, 2026): no advisory affects it
Newest unaffected release
3.14.5 (Oct 11, 2026), the latest release
Advisories
53 · 7 high, 30 medium, 16 low
Weekly downloads
128.6M
Dependents
47.8K
Releases
315 since 0.1.0 (Oct 25, 2013)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 53 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 53

  • CVE-2026-111750Medium 6.3

    AIOHTTP: Pure-Python parser request smuggling

    Affected: fixed in 3.14.4.

    Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

    Affected: fixed in 3.14.4.

    Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-111748Medium 6.3

    AIOHTTP: Absolute-form request targets can spoof Request.scheme

    Affected: fixed in 3.14.4.

    Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP: File descriptor exhaustion in multipart requests

    Affected: from 2.0.0, fixed in 3.14.4.

    Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-111065Medium 6.9

    AIOHTTP: Connector pool exhaustion via Max-Age overflow

    Affected: fixed in 3.14.4.

    Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • aiohttp server lacks an initial request/header timeout

    Affected: fixed in 3.14.4.

    Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-111063Medium 6.3

    AIOHTTP: Secure attribute not enforced for shared cookie

    Affected: fixed in 3.14.4.

    Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

    Affected: fixed in 3.14.3.

    Fixed in 3.14.3 (released Jul 23, 2026, 11 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-69243Medium 6.3

    AIOHTTP: HTTP request smuggling via WebSocket upgrade

    Affected: fixed in 3.14.2.

    Fixed in 3.14.2 (released Jul 20, 2026, 14 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-59881Medium 6.9

    AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

    Affected: fixed in 3.14.2.

    Fixed in 3.14.2 (released Jul 20, 2026, 10 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-54273Medium 6.6

    AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

    Affected: fixed in 3.14.1.

    Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

    Affected: fixed in 3.14.1.

    Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-54278Medium 6.6

    AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

    Affected: fixed in 3.14.1.

    Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-54277Medium 6.6

    AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

    Affected: fixed in 3.14.1.

    Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-54276Medium 6.3

    AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

    Affected: fixed in 3.14.1.

    Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure).

    The latest release, 3.14.5, is not affected.

Show all 53 advisoriesShow fewer advisories

  • AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

    Affected: fixed in 3.14.1.

    Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-54274Medium 6.6

    AIOHTTP: Incomplete websocket frame payloads bypass memory limits

    Affected: fixed in 3.14.1.

    Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

    Affected: fixed in 3.14.1.

    Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP: CRLF injection in multipart headers

    Affected: fixed in 3.14.0.

    Fixed in 3.14.0 (released Jun 1, 2026, 21 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-47265Medium 6.6

    AIOHTTP vulnerable to cross-origin redirect with per-request cookies

    Affected: fixed in 3.14.0.

    Fixed in 3.14.0 (released Jun 1, 2026, 1 day before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-34993Medium 6.4

    AIOHTTP Vulnerable to Deserialization of Untrusted Data

    Affected: fixed in 3.14.0.

    Fixed in 3.14.0 (released Jun 1, 2026, 1 day before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-34525Medium 6.3

    AIOHTTP: Duplicate Host header accepted

    Affected: fixed in 3.13.4.

    Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass

    Affected: fixed in 3.13.4.

    Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP: HTTP response splitting via \r in reason phrase

    Affected: fixed in 3.13.4.

    Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

    Affected: fixed in 3.13.4.

    Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS

    Affected: fixed in 3.13.4.

    Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-34516Medium 6.6

    AIOHTTP: Multipart Header Size Bypass

    Affected: fixed in 3.13.4.

    Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-34515Medium 6.6

    AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

    Affected: fixed in 3.13.4.

    Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP: CRLF injection in multipart part content type header construction

    Affected: fixed in 3.13.4.

    Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2026-22815Medium 6.9

    AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

    Affected: fixed in 3.13.4.

    Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

    Affected: fixed in 3.13.4.

    Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP Vulnerable to Cookie Parser Warning Storm

    Affected: fixed in 3.13.3.

    Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2025-69229Medium 6.6

    AIOHTTP vulnerable to DoS through chunked messages

    Affected: fixed in 3.13.3.

    Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2025-69228Medium 6.6

    AIOHTTP vulnerable to denial of service through large payloads

    Affected: fixed in 3.13.3.

    Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2025-69227Medium 6.6

    AIOHTTP vulnerable to DoS when bypassing asserts

    Affected: fixed in 3.13.3.

    Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields

    Affected: fixed in 3.13.3.

    Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2025-69226Medium 6.3

    AIOHTTP allows for a brute-force leak of internal static filepath components

    Affected: fixed in 3.13.3.

    Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2025-69224Medium 6.3

    AIOHTTP's Unicode processing of header values could cause parsing discrepancies

    Affected: fixed in 3.13.3.

    Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

    Affected: fixed in 3.13.3.

    Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

    Affected: fixed in 3.12.14.

    Fixed in 3.12.14 (released Jul 10, 2025, 4 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2024-52304Medium 6.3

    aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

    Affected: fixed in 3.10.11.

    Fixed in 3.10.11 (released Nov 13, 2024, 5 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method

    Affected: from 3.10.6, fixed in 3.10.11.

    Fixed in 3.10.11 (released Nov 13, 2024, 5 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2024-42367Medium 4.8

    In aiohttp, compressed files as symlinks are not protected from path traversal

    Affected: from 3.10.0b1, fixed in 3.10.2.

    Fixed in 3.10.2 (released Aug 8, 2024, 1 day before disclosure).

    The latest release, 3.14.5, is not affected.

  • Denial of service when trying to parse malformed POST requests in aiohttp

    Affected: fixed in 3.9.4.

    Fixed in 3.9.4 (released Apr 11, 2024, 21 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2024-27306Medium 6.1

    aiohttp vulnerable to XSS on index pages for static file handling

    Affected: fixed in 3.9.4.

    Fixed in 3.9.4 (released Apr 11, 2024, 7 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2024-23334Medium 5.9

    aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

    Affected: from 1.0.5, fixed in 3.9.2.

    Fixed in 3.9.2 (released Jan 28, 2024, 1 day before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2024-23829Medium 6.5

    aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

    Affected: fixed in 3.9.2.

    Fixed in 3.9.2 (released Jan 28, 2024, 1 day before disclosure).

    The latest release, 3.14.5, is not affected.

  • aiohttp's ClientSession is vulnerable to CRLF injection via version

    Affected: fixed in 3.9.0.

    Fixed in 3.9.0 (released Nov 18, 2023, 12 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2023-49082Medium 5.3

    aiohttp's ClientSession is vulnerable to CRLF injection via method

    Affected: fixed in 3.9.0.

    Fixed in 3.9.0 (released Nov 18, 2023, 11 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2023-47627Medium 5.3

    Request smuggling in aiohttp

    Affected: fixed in 3.8.6.

    Fixed in 3.8.6 (released Oct 7, 2023, 38 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp

    Affected: fixed in 3.8.0.

    Fixed in 3.8.0 (released Oct 31, 2021, 744 days before disclosure).

    The latest release, 3.14.5, is not affected.

  • CVE-2023-37276Medium 5.3

    aiohttp vulnerable to HTTP request smuggling

    Affected: fixed in 3.8.5.

    Fixed in 3.8.5 (released Jul 19, 2023, the day of disclosure).

    The latest release, 3.14.5, is not affected.

  • Open redirect vulnerability in aiohttp

    Affected: fixed in 3.7.4; fixed in 3.7.4.

    Fixed in 3.7.4 (released Feb 25, 2021, 1 day before disclosure).

    The latest release, 3.14.5, is not affected.