Aio-libs vulnerabilities
59 CVEs and advisories name Aio-libs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-34514AIOHTTP: CRLF injection in multipart part content type header construction
- CVE-2026-22815AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers
- CVE-2026-34513AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector
- CVE-2025-69230AIOHTTP Vulnerable to Cookie Parser Warning Storm
- CVE-2025-69229AIOHTTP vulnerable to DoS through chunked messages
- CVE-2025-69228AIOHTTP vulnerable to denial of service through large payloads
- CVE-2025-69227AIOHTTP vulnerable to DoS when bypassing asserts
- CVE-2025-69225AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields
- CVE-2025-69226AIOHTTP allows for a brute-force leak of internal static filepath components
- CVE-2025-69224AIOHTTP's Unicode processing of header values could cause parsing discrepancies
- CVE-2025-69223AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
- CVE-2025-62611aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server
- CVE-2025-53643AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections
- CVE-2025-48945pycares has a Use-After-Free Vulnerability
- CVE-2024-52304aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions
- CVE-2024-52303aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
- CVE-2024-42367In aiohttp, compressed files as symlinks are not protected from path traversal
- CVE-2024-34083STARTTLS unencrypted commands injection
- CVE-2024-30251Denial of service when trying to parse malformed POST requests in aiohttp
- CVE-2024-27306aiohttp vulnerable to XSS on index pages for static file handling
- CVE-2024-27305SMTP smuggling in aiosmtpd
- CVE-2024-23334aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
- CVE-2024-23829aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
- CVE-2023-49081aiohttp's ClientSession is vulnerable to CRLF injection via version
- CVE-2023-49082aiohttp's ClientSession is vulnerable to CRLF injection via method
- CVE-2023-47627Request smuggling in aiohttp
- CVE-2023-47641Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp
- CVE-2023-37276aiohttp vulnerable to HTTP request smuggling
- CVE-2021-21330Open redirect vulnerability in aiohttp