# aiohttp (PyPI) vulnerabilities 53 known vulnerabilities (7 high, 30 medium, 16 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.14.5 (Oct 11, 2026): no advisory affects it - Newest unaffected release: 3.14.5 (Oct 11, 2026), the latest release - Weekly downloads: 128.6M - Dependents: 47.8K - Releases: 315 since 0.1.0 (Oct 25, 2013) - Registry: https://pypi.org/project/aiohttp/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-111750: 0.1.0 to 3.14.3 (3.14.4 is outside it) - CVE-2026-111749: 0.1.0 to 3.14.3 (3.14.4 is outside it) - CVE-2026-111748: 0.1.0 to 3.14.3 (3.14.4 is outside it) - CVE-2026-111066: 2.0.0 to 3.14.3 (3.14.4 is outside it) - CVE-2026-111065: 0.1.0 to 3.14.3 (3.14.4 is outside it) - CVE-2026-111064: 0.1.0 to 3.14.3 (3.14.4 is outside it) - CVE-2026-111063: 0.1.0 to 3.14.3 (3.14.4 is outside it) - CVE-2026-69244: 0.1.0 to 3.14.2 (3.14.3 is outside it) - CVE-2026-69243: 0.1.0 to 3.14.1 (3.14.2 is outside it) - CVE-2026-59881: 0.1.0 to 3.14.1 (3.14.2 is outside it) - CVE-2026-54273: 0.1.0 to 3.14.0 (3.14.1 is outside it) - CVE-2026-54280: 0.1.0 to 3.14.0 (3.14.1 is outside it) - CVE-2026-54278: 0.1.0 to 3.14.0 (3.14.1 is outside it) - CVE-2026-54277: 0.1.0 to 3.14.0 (3.14.1 is outside it) - CVE-2026-54276: 0.1.0 to 3.14.0 (3.14.1 is outside it) - CVE-2026-54275: 0.1.0 to 3.14.0 (3.14.1 is outside it) - CVE-2026-54274: 0.1.0 to 3.14.0 (3.14.1 is outside it) - CVE-2026-54279: 0.1.0 to 3.14.0 (3.14.1 is outside it) - CVE-2026-50269: 0.1.0 to 3.13.5 (3.14.0 is outside it) - CVE-2026-47265: 0.1.0 to 3.13.5 (3.14.0 is outside it) - CVE-2026-34993: 0.1.0 to 3.13.5 (3.14.0 is outside it) - CVE-2026-34525: 0.1.0 to 3.13.3 (3.13.4 is outside it) - CVE-2026-34520: 0.1.0 to 3.13.3 (3.13.4 is outside it) - CVE-2026-34519: 0.1.0 to 3.13.3 (3.13.4 is outside it) - CVE-2026-34518: 0.1.0 to 3.13.3 (3.13.4 is outside it) - CVE-2026-34517: 0.1.0 to 3.13.3 (3.13.4 is outside it) - CVE-2026-34516: 0.1.0 to 3.13.3 (3.13.4 is outside it) - CVE-2026-34515: 0.1.0 to 3.13.3 (3.13.4 is outside it) - CVE-2026-34514: 0.1.0 to 3.13.3 (3.13.4 is outside it) - CVE-2026-22815: 0.1.0 to 3.13.3 (3.13.4 is outside it) - CVE-2026-34513: 0.1.0 to 3.13.3 (3.13.4 is outside it) - CVE-2025-69230: 0.1.0 to 3.13.2 (3.13.3 is outside it) - CVE-2025-69229: 0.1.0 to 3.13.2 (3.13.3 is outside it) - CVE-2025-69228: 0.1.0 to 3.13.2 (3.13.3 is outside it) - CVE-2025-69227: 0.1.0 to 3.13.2 (3.13.3 is outside it) - CVE-2025-69225: 0.1.0 to 3.13.2 (3.13.3 is outside it) - CVE-2025-69226: 0.1.0 to 3.13.2 (3.13.3 is outside it) - CVE-2025-69224: 0.1.0 to 3.13.2 (3.13.3 is outside it) - CVE-2025-69223: 0.1.0 to 3.13.2 (3.13.3 is outside it) - CVE-2025-53643: 0.1.0 to 3.12.13 (3.12.14 is outside it) - CVE-2024-52304: 0.1.0 to 3.10.11rc0 (3.10.11 is outside it) - CVE-2024-52303: 3.10.6 to 3.10.11rc0 (3.10.11 is outside it) - CVE-2024-42367: 3.10.0b1 to 3.10.1 (3.10.2 is outside it) - CVE-2024-30251: 0.1.0 to 3.9.4rc0 (3.9.4 is outside it) - CVE-2024-27306: 0.1.0 to 3.9.4rc0 (3.9.4 is outside it) - CVE-2024-23334: 1.0.5 to 3.9.1 (3.9.2 is outside it) - CVE-2024-23829: 0.1.0 to 3.9.1 (3.9.2 is outside it) - CVE-2023-49081: 0.1.0 to 3.9.0rc0 (3.9.0 is outside it) - CVE-2023-49082: 0.1.0 to 3.9.0rc0 (3.9.0 is outside it) - CVE-2023-47627: 0.1.0 to 3.8.5 (3.8.6 is outside it) - CVE-2023-47641: 0.1.0 to 3.8.0b0 (3.8.0 is outside it) - CVE-2023-37276: 0.1.0 to 3.8.4 (3.8.5 is outside it) - CVE-2021-21330: 0.1.0 to 3.7.3 (3.7.4 is outside it) ## Advisories (53) ### [CVE-2026-111750](https://cve.now/CVE-2026-111750): AIOHTTP: Pure-Python parser request smuggling - Severity: Medium 6.3 - Published: Oct 19, 2026 - Affected: fixed in 3.14.4. - Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-111749](https://cve.now/CVE-2026-111749): AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies - Severity: Low 2.3 - Published: Oct 19, 2026 - Affected: fixed in 3.14.4. - Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-111748](https://cve.now/CVE-2026-111748): AIOHTTP: Absolute-form request targets can spoof Request.scheme - Severity: Medium 6.3 - Published: Oct 19, 2026 - Affected: fixed in 3.14.4. - Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-111066](https://cve.now/CVE-2026-111066): AIOHTTP: File descriptor exhaustion in multipart requests - Severity: High 8.2 - Published: Oct 19, 2026 - Affected: from 2.0.0, fixed in 3.14.4. - Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-111065](https://cve.now/CVE-2026-111065): AIOHTTP: Connector pool exhaustion via Max-Age overflow - Severity: Medium 6.9 - Published: Oct 19, 2026 - Affected: fixed in 3.14.4. - Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-111064](https://cve.now/CVE-2026-111064): aiohttp server lacks an initial request/header timeout - Severity: High 8.2 - Published: Oct 19, 2026 - Affected: fixed in 3.14.4. - Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-111063](https://cve.now/CVE-2026-111063): AIOHTTP: Secure attribute not enforced for shared cookie - Severity: Medium 6.3 - Published: Oct 19, 2026 - Affected: fixed in 3.14.4. - Fixed in 3.14.4 (released Oct 5, 2026, 14 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-69244](https://cve.now/CVE-2026-69244): AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) - Severity: High 7.1 - Published: Aug 3, 2026 - Affected: fixed in 3.14.3. - Fixed in 3.14.3 (released Jul 23, 2026, 11 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-69243](https://cve.now/CVE-2026-69243): AIOHTTP: HTTP request smuggling via WebSocket upgrade - Severity: Medium 6.3 - Published: Aug 3, 2026 - Affected: fixed in 3.14.2. - Fixed in 3.14.2 (released Jul 20, 2026, 14 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-59881](https://cve.now/CVE-2026-59881): AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate - Severity: Medium 6.9 - Published: Jul 30, 2026 - Affected: fixed in 3.14.2. - Fixed in 3.14.2 (released Jul 20, 2026, 10 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-54273](https://cve.now/CVE-2026-54273): AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit - Severity: Medium 6.6 - Published: Jun 22, 2026 - Affected: fixed in 3.14.1. - Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-54280](https://cve.now/CVE-2026-54280): AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect - Severity: Low 1.7 - Published: Jun 22, 2026 - Affected: fixed in 3.14.1. - Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-54278](https://cve.now/CVE-2026-54278): AIOHTTP: Unread Compressed Request Bodies Bypass client\_max\_size During Cleanup - Severity: Medium 6.6 - Published: Jun 22, 2026 - Affected: fixed in 3.14.1. - Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-54277](https://cve.now/CVE-2026-54277): AIOHTTP: C HTTP Parser Bypasses max\_line\_size for Fragmented Lines - Severity: Medium 6.6 - Published: Jun 22, 2026 - Affected: fixed in 3.14.1. - Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-54276](https://cve.now/CVE-2026-54276): AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges - Severity: Medium 6.3 - Published: Jun 22, 2026 - Affected: fixed in 3.14.1. - Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-54275](https://cve.now/CVE-2026-54275): AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections - Severity: Low 2.7 - Published: Jun 22, 2026 - Affected: fixed in 3.14.1. - Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-54274](https://cve.now/CVE-2026-54274): AIOHTTP: Incomplete websocket frame payloads bypass memory limits - Severity: Medium 6.6 - Published: Jun 22, 2026 - Affected: fixed in 3.14.1. - Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-54279](https://cve.now/CVE-2026-54279): AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence - Severity: Low 1.3 - Published: Jun 22, 2026 - Affected: fixed in 3.14.1. - Fixed in 3.14.1 (released Jun 7, 2026, 15 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-50269](https://cve.now/CVE-2026-50269): AIOHTTP: CRLF injection in multipart headers - Severity: Low 2.7 - Published: Jun 22, 2026 - Affected: fixed in 3.14.0. - Fixed in 3.14.0 (released Jun 1, 2026, 21 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-47265](https://cve.now/CVE-2026-47265): AIOHTTP vulnerable to cross-origin redirect with per-request cookies - Severity: Medium 6.6 - Published: Jun 2, 2026 - Affected: fixed in 3.14.0. - Fixed in 3.14.0 (released Jun 1, 2026, 1 day before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-34993](https://cve.now/CVE-2026-34993): AIOHTTP Vulnerable to Deserialization of Untrusted Data - Severity: Medium 6.4 - Published: Jun 2, 2026 - Affected: fixed in 3.14.0. - Fixed in 3.14.0 (released Jun 1, 2026, 1 day before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-34525](https://cve.now/CVE-2026-34525): AIOHTTP: Duplicate Host header accepted - Severity: Medium 6.3 - Published: Apr 1, 2026 - Affected: fixed in 3.13.4. - Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-34520](https://cve.now/CVE-2026-34520): AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass - Severity: Low 2.7 - Published: Apr 1, 2026 - Affected: fixed in 3.13.4. - Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-34519](https://cve.now/CVE-2026-34519): AIOHTTP: HTTP response splitting via \\r in reason phrase - Severity: Low 2.7 - Published: Apr 1, 2026 - Affected: fixed in 3.13.4. - Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-34518](https://cve.now/CVE-2026-34518): AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect - Severity: Low 2.7 - Published: Apr 1, 2026 - Affected: fixed in 3.13.4. - Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-34517](https://cve.now/CVE-2026-34517): AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS - Severity: Low 2.7 - Published: Apr 1, 2026 - Affected: fixed in 3.13.4. - Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-34516](https://cve.now/CVE-2026-34516): AIOHTTP: Multipart Header Size Bypass - Severity: Medium 6.6 - Published: Apr 1, 2026 - Affected: fixed in 3.13.4. - Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-34515](https://cve.now/CVE-2026-34515): AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows - Severity: Medium 6.6 - Published: Apr 1, 2026 - Affected: fixed in 3.13.4. - Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-34514](https://cve.now/CVE-2026-34514): AIOHTTP: CRLF injection in multipart part content type header construction - Severity: Low 2.7 - Published: Apr 1, 2026 - Affected: fixed in 3.13.4. - Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-22815](https://cve.now/CVE-2026-22815): AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers - Severity: Medium 6.9 - Published: Apr 1, 2026 - Affected: fixed in 3.13.4. - Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2026-34513](https://cve.now/CVE-2026-34513): AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector - Severity: Low 2.7 - Published: Apr 1, 2026 - Affected: fixed in 3.13.4. - Fixed in 3.13.4 (released Mar 28, 2026, 4 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2025-69230](https://cve.now/CVE-2025-69230): AIOHTTP Vulnerable to Cookie Parser Warning Storm - Severity: Low 2.7 - Published: Jan 5, 2026 - Affected: fixed in 3.13.3. - Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2025-69229](https://cve.now/CVE-2025-69229): AIOHTTP vulnerable to DoS through chunked messages - Severity: Medium 6.6 - Published: Jan 5, 2026 - Affected: fixed in 3.13.3. - Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2025-69228](https://cve.now/CVE-2025-69228): AIOHTTP vulnerable to denial of service through large payloads - Severity: Medium 6.6 - Published: Jan 5, 2026 - Affected: fixed in 3.13.3. - Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2025-69227](https://cve.now/CVE-2025-69227): AIOHTTP vulnerable to DoS when bypassing asserts - Severity: Medium 6.6 - Published: Jan 5, 2026 - Affected: fixed in 3.13.3. - Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2025-69225](https://cve.now/CVE-2025-69225): AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields - Severity: Low 2.7 - Published: Jan 5, 2026 - Affected: fixed in 3.13.3. - Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2025-69226](https://cve.now/CVE-2025-69226): AIOHTTP allows for a brute-force leak of internal static filepath components - Severity: Medium 6.3 - Published: Jan 5, 2026 - Affected: fixed in 3.13.3. - Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2025-69224](https://cve.now/CVE-2025-69224): AIOHTTP's Unicode processing of header values could cause parsing discrepancies - Severity: Medium 6.3 - Published: Jan 5, 2026 - Affected: fixed in 3.13.3. - Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2025-69223](https://cve.now/CVE-2025-69223): AIOHTTP's HTTP Parser auto\_decompress feature is vulnerable to zip bomb - Severity: High 7.5 - Published: Jan 5, 2026 - Affected: fixed in 3.13.3. - Fixed in 3.13.3 (released Jan 3, 2026, 2 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2025-53643](https://cve.now/CVE-2025-53643): AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections - Severity: Low 1.7 - Published: Jul 14, 2025 - Affected: fixed in 3.12.14. - Fixed in 3.12.14 (released Jul 10, 2025, 4 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2024-52304](https://cve.now/CVE-2024-52304): aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions - Severity: Medium 6.3 - Published: Nov 18, 2024 - Affected: fixed in 3.10.11. - Fixed in 3.10.11 (released Nov 13, 2024, 5 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2024-52303](https://cve.now/CVE-2024-52303): aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method - Severity: High 8.7 - Published: Nov 18, 2024 - Affected: from 3.10.6, fixed in 3.10.11. - Fixed in 3.10.11 (released Nov 13, 2024, 5 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2024-42367](https://cve.now/CVE-2024-42367): In aiohttp, compressed files as symlinks are not protected from path traversal - Severity: Medium 4.8 - Published: Aug 9, 2024 - Affected: from 3.10.0b1, fixed in 3.10.2. - Fixed in 3.10.2 (released Aug 8, 2024, 1 day before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2024-30251](https://cve.now/CVE-2024-30251): Denial of service when trying to parse malformed POST requests in aiohttp - Severity: High 7.5 - Published: May 2, 2024 - Affected: fixed in 3.9.4. - Fixed in 3.9.4 (released Apr 11, 2024, 21 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2024-27306](https://cve.now/CVE-2024-27306): aiohttp vulnerable to XSS on index pages for static file handling - Severity: Medium 6.1 - Published: Apr 18, 2024 - Affected: fixed in 3.9.4. - Fixed in 3.9.4 (released Apr 11, 2024, 7 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2024-23334](https://cve.now/CVE-2024-23334): aiohttp.web.static(follow\_symlinks=True) is vulnerable to directory traversal - Severity: Medium 5.9 - Published: Jan 29, 2024 - Affected: from 1.0.5, fixed in 3.9.2. - Fixed in 3.9.2 (released Jan 28, 2024, 1 day before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2024-23829](https://cve.now/CVE-2024-23829): aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators - Severity: Medium 6.5 - Published: Jan 29, 2024 - Affected: fixed in 3.9.2. - Fixed in 3.9.2 (released Jan 28, 2024, 1 day before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2023-49081](https://cve.now/CVE-2023-49081): aiohttp's ClientSession is vulnerable to CRLF injection via version - Severity: High 7.2 - Published: Nov 30, 2023 - Affected: fixed in 3.9.0. - Fixed in 3.9.0 (released Nov 18, 2023, 12 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2023-49082](https://cve.now/CVE-2023-49082): aiohttp's ClientSession is vulnerable to CRLF injection via method - Severity: Medium 5.3 - Published: Nov 29, 2023 - Affected: fixed in 3.9.0. - Fixed in 3.9.0 (released Nov 18, 2023, 11 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2023-47627](https://cve.now/CVE-2023-47627): Request smuggling in aiohttp - Severity: Medium 5.3 - Published: Nov 14, 2023 - Affected: fixed in 3.8.6. - Fixed in 3.8.6 (released Oct 7, 2023, 38 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2023-47641](https://cve.now/CVE-2023-47641): Inconsistent interpretation of \`Content-Length\` vs. \`Transfer-Encoding\` in aiohttp - Severity: Low 3.4 - Published: Nov 14, 2023 - Affected: fixed in 3.8.0. - Fixed in 3.8.0 (released Oct 31, 2021, 744 days before disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2023-37276](https://cve.now/CVE-2023-37276): aiohttp vulnerable to HTTP request smuggling - Severity: Medium 5.3 - Published: Jul 19, 2023 - Affected: fixed in 3.8.5. - Fixed in 3.8.5 (released Jul 19, 2023, the day of disclosure). - The latest release, 3.14.5, is not affected. ### [CVE-2021-21330](https://cve.now/CVE-2021-21330): Open redirect vulnerability in aiohttp - Severity: Low 3.1 - Published: Feb 26, 2021 - Affected: fixed in 3.7.4; fixed in 3.7.4. - Fixed in 3.7.4 (released Feb 25, 2021, 1 day before disclosure). - The latest release, 3.14.5, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/aiohttp Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.