# cve.now: Aio-libs

The newest entries naming Aio-libs as an affected vendor (up to 200), of 59 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123817](https://cve.now/CVE-2026-123817.md): AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads (CVSS 8.7)
- [CVE-2026-111750](https://cve.now/CVE-2026-111750.md): AIOHTTP: Pure-Python parser request smuggling (CVSS 6.3)
- [CVE-2026-111749](https://cve.now/CVE-2026-111749.md): AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies (CVSS 2.3)
- [CVE-2026-111748](https://cve.now/CVE-2026-111748.md): AIOHTTP: Absolute-form request targets can spoof Request.scheme (CVSS 6.3)
- [CVE-2026-111066](https://cve.now/CVE-2026-111066.md): AIOHTTP: File descriptor exhaustion in multipart requests (CVSS 8.2)
- [CVE-2026-111065](https://cve.now/CVE-2026-111065.md): AIOHTTP: Connector pool exhaustion via Max-Age overflow (CVSS 6.9)
- [CVE-2026-111064](https://cve.now/CVE-2026-111064.md): aiohttp server lacks an initial request/header timeout (CVSS 8.2)
- [CVE-2026-111063](https://cve.now/CVE-2026-111063.md): AIOHTTP: Secure attribute not enforced for shared cookie (CVSS 6.3)
- [CVE-2026-104874](https://cve.now/CVE-2026-104874.md): Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction (CVSS 5.3)
- [CVE-2026-69244](https://cve.now/CVE-2026-69244.md): AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) (CVSS 7.1)
- [CVE-2026-69243](https://cve.now/CVE-2026-69243.md): AIOHTTP: HTTP request smuggling via WebSocket upgrade (CVSS 6.3)
- [CVE-2026-59881](https://cve.now/CVE-2026-59881.md): AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate (CVSS 6.9)
- [CVE-2026-54273](https://cve.now/CVE-2026-54273.md): AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit (CVSS 6.6)
- [CVE-2026-54280](https://cve.now/CVE-2026-54280.md): AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect (CVSS 1.7)
- [CVE-2026-54278](https://cve.now/CVE-2026-54278.md): AIOHTTP: Unread Compressed Request Bodies Bypass client\_max\_size During Cleanup (CVSS 6.6)
- [CVE-2026-54277](https://cve.now/CVE-2026-54277.md): AIOHTTP: C HTTP Parser Bypasses max\_line\_size for Fragmented Lines (CVSS 6.6)
- [CVE-2026-54276](https://cve.now/CVE-2026-54276.md): AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges (CVSS 6.3)
- [CVE-2026-54275](https://cve.now/CVE-2026-54275.md): AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections (CVSS 2.7)
- [CVE-2026-54274](https://cve.now/CVE-2026-54274.md): AIOHTTP: Incomplete websocket frame payloads bypass memory limits (CVSS 6.6)
- [CVE-2026-54279](https://cve.now/CVE-2026-54279.md): AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence (CVSS 1.3)
- [CVE-2026-50269](https://cve.now/CVE-2026-50269.md): AIOHTTP: CRLF injection in multipart headers (CVSS 2.7)
- [CVE-2026-47265](https://cve.now/CVE-2026-47265.md): AIOHTTP vulnerable to cross-origin redirect with per-request cookies (CVSS 6.6)
- [CVE-2026-34993](https://cve.now/CVE-2026-34993.md): AIOHTTP Vulnerable to Deserialization of Untrusted Data (CVSS 6.4)
- [CVE-2026-34525](https://cve.now/CVE-2026-34525.md): AIOHTTP: Duplicate Host header accepted (CVSS 6.3)
- [CVE-2026-34520](https://cve.now/CVE-2026-34520.md): AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass (CVSS 2.7)
- [CVE-2026-34519](https://cve.now/CVE-2026-34519.md): AIOHTTP: HTTP response splitting via \\r in reason phrase (CVSS 2.7)
- [CVE-2026-34518](https://cve.now/CVE-2026-34518.md): AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect (CVSS 2.7)
- [CVE-2026-34517](https://cve.now/CVE-2026-34517.md): AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS (CVSS 2.7)
- [CVE-2026-34516](https://cve.now/CVE-2026-34516.md): AIOHTTP: Multipart Header Size Bypass (CVSS 6.6)
- [CVE-2026-34515](https://cve.now/CVE-2026-34515.md): AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows (CVSS 6.6)
- [CVE-2026-34514](https://cve.now/CVE-2026-34514.md): AIOHTTP: CRLF injection in multipart part content type header construction (CVSS 2.7)
- [CVE-2026-22815](https://cve.now/CVE-2026-22815.md): AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers (CVSS 6.9)
- [CVE-2026-34513](https://cve.now/CVE-2026-34513.md): AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector (CVSS 2.7)
- [CVE-2025-69230](https://cve.now/CVE-2025-69230.md): AIOHTTP Vulnerable to Cookie Parser Warning Storm (CVSS 2.7)
- [CVE-2025-69229](https://cve.now/CVE-2025-69229.md): AIOHTTP vulnerable to DoS through chunked messages (CVSS 6.6)
- [CVE-2025-69228](https://cve.now/CVE-2025-69228.md): AIOHTTP vulnerable to denial of service through large payloads (CVSS 6.6)
- [CVE-2025-69227](https://cve.now/CVE-2025-69227.md): AIOHTTP vulnerable to DoS when bypassing asserts (CVSS 6.6)
- [CVE-2025-69225](https://cve.now/CVE-2025-69225.md): AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields (CVSS 2.7)
- [CVE-2025-69226](https://cve.now/CVE-2025-69226.md): AIOHTTP allows for a brute-force leak of internal static filepath components (CVSS 6.3)
- [CVE-2025-69224](https://cve.now/CVE-2025-69224.md): AIOHTTP's Unicode processing of header values could cause parsing discrepancies (CVSS 6.3)
- [CVE-2025-69223](https://cve.now/CVE-2025-69223.md): AIOHTTP's HTTP Parser auto\_decompress feature is vulnerable to zip bomb (CVSS 7.5)
- [CVE-2025-62611](https://cve.now/CVE-2025-62611.md): aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server (CVSS 8.2)
- [CVE-2025-53643](https://cve.now/CVE-2025-53643.md): AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections (CVSS 1.7)
- [CVE-2025-48945](https://cve.now/CVE-2025-48945.md): pycares has a Use-After-Free Vulnerability (CVSS 8.2)
- [CVE-2024-52304](https://cve.now/CVE-2024-52304.md): aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVSS 6.3)
- [CVE-2024-52303](https://cve.now/CVE-2024-52303.md): aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method (CVSS 8.7)
- [CVE-2024-42367](https://cve.now/CVE-2024-42367.md): In aiohttp, compressed files as symlinks are not protected from path traversal (CVSS 4.8)
- [CVE-2024-34083](https://cve.now/CVE-2024-34083.md): STARTTLS unencrypted commands injection (CVSS 5.4)
- [CVE-2024-30251](https://cve.now/CVE-2024-30251.md): Denial of service when trying to parse malformed POST requests in aiohttp (CVSS 7.5)
- [CVE-2024-27306](https://cve.now/CVE-2024-27306.md): aiohttp vulnerable to XSS on index pages for static file handling (CVSS 6.1)
- [CVE-2024-27305](https://cve.now/CVE-2024-27305.md): SMTP smuggling in aiosmtpd (CVSS 5.3)
- [CVE-2024-23334](https://cve.now/CVE-2024-23334.md): aiohttp.web.static(follow\_symlinks=True) is vulnerable to directory traversal (CVSS 5.9)
- [CVE-2024-23829](https://cve.now/CVE-2024-23829.md): aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators (CVSS 6.5)
- [CVE-2023-49081](https://cve.now/CVE-2023-49081.md): aiohttp's ClientSession is vulnerable to CRLF injection via version (CVSS 7.2)
- [CVE-2023-49082](https://cve.now/CVE-2023-49082.md): aiohttp's ClientSession is vulnerable to CRLF injection via method (CVSS 5.3)
- [CVE-2023-47627](https://cve.now/CVE-2023-47627.md): Request smuggling in aiohttp (CVSS 5.3)
- [CVE-2023-47641](https://cve.now/CVE-2023-47641.md): Inconsistent interpretation of \`Content-Length\` vs. \`Transfer-Encoding\` in aiohttp (CVSS 3.4)
- [CVE-2023-37276](https://cve.now/CVE-2023-37276.md): aiohttp vulnerable to HTTP request smuggling (CVSS 5.3)
- [CVE-2021-21330](https://cve.now/CVE-2021-21330.md): Open redirect vulnerability in aiohttp (CVSS 3.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/aio-libs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.