Aio-libs vulnerabilities
59 CVEs and advisories name Aio-libs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-123817AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads
- CVE-2026-111750AIOHTTP: Pure-Python parser request smuggling
- CVE-2026-111749AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
- CVE-2026-111748AIOHTTP: Absolute-form request targets can spoof Request.scheme
- CVE-2026-111066AIOHTTP: File descriptor exhaustion in multipart requests
- CVE-2026-111065AIOHTTP: Connector pool exhaustion via Max-Age overflow
- CVE-2026-111064aiohttp server lacks an initial request/header timeout
- CVE-2026-111063AIOHTTP: Secure attribute not enforced for shared cookie
- CVE-2026-104874Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
- CVE-2026-69244AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
- CVE-2026-69243AIOHTTP: HTTP request smuggling via WebSocket upgrade
- CVE-2026-59881AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
- CVE-2026-54273AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit
- CVE-2026-54280AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect
- CVE-2026-54278AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
- CVE-2026-54277AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines
- CVE-2026-54276AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
- CVE-2026-54275AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
- CVE-2026-54274AIOHTTP: Incomplete websocket frame payloads bypass memory limits
- CVE-2026-54279AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
- CVE-2026-50269AIOHTTP: CRLF injection in multipart headers
- CVE-2026-47265AIOHTTP vulnerable to cross-origin redirect with per-request cookies
- CVE-2026-34993AIOHTTP Vulnerable to Deserialization of Untrusted Data
- CVE-2026-34525AIOHTTP: Duplicate Host header accepted
- CVE-2026-34520AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass
- CVE-2026-34519AIOHTTP: HTTP response splitting via \r in reason phrase
- CVE-2026-34518AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect
- CVE-2026-34517AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS
- CVE-2026-34516AIOHTTP: Multipart Header Size Bypass
- CVE-2026-34515AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows