aio-libs aiohttp
53 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-111750 | < 3.14.4 | AIOHTTP: Pure-Python parser request smuggling | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-111749 | < 3.14.4 | AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies | LOW 2.3 | 0.4 % | ||
| CVE-2026-111748 | < 3.14.4 | AIOHTTP: Absolute-form request targets can spoof Request.scheme | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-111066 | >= 2.0.0, < 3.14.4 | AIOHTTP: File descriptor exhaustion in multipart requests | HIGH 8.2 | 0.4 % | ||
| CVE-2026-111065 | < 3.14.4 | AIOHTTP: Connector pool exhaustion via Max-Age overflow | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-111064 | < 3.14.4 | aiohttp server lacks an initial request/header timeout | HIGH 8.2 | 0.4 % | ||
| CVE-2026-111063 | < 3.14.4 | AIOHTTP: Secure attribute not enforced for shared cookie | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-69244 | < 3.14.3 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) | HIGH 7.1 | 0.5 % | ||
| CVE-2026-69243 | < 3.14.2 | AIOHTTP: HTTP request smuggling via WebSocket upgrade | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-59881 | < 3.14.2 | AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate | MEDIUM 6.9 | 0.5 % | ||
| CVE-2026-54273 | < 3.14.1 | AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit | MEDIUM 6.6 | 0.5 % | ||
| CVE-2026-54280 | < 3.14.1 | AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect | LOW 1.7 | 0.5 % | ||
| CVE-2026-54278 | < 3.14.1 | AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup | MEDIUM 6.6 | 0.5 % | ||
| CVE-2026-54277 | < 3.14.1 | AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines | MEDIUM 6.6 | 0.6 % | ||
| CVE-2026-54276 | < 3.14.1 | AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-54275 | < 3.14.1 | AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections | LOW 2.7 | 0.5 % | ||
| CVE-2026-54274 | < 3.14.1 | AIOHTTP: Incomplete websocket frame payloads bypass memory limits | MEDIUM 6.6 | 0.5 % | ||
| CVE-2026-54279 | < 3.14.1 | AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence | LOW 1.3 | 0.5 % | ||
| CVE-2026-50269 | < 3.14.0 | AIOHTTP: CRLF injection in multipart headers | LOW 2.7 | 0.5 % | ||
| CVE-2026-47265 | < 3.14.0 | AIOHTTP vulnerable to cross-origin redirect with per-request cookies | MEDIUM 6.6 | 0.1 % | ||
| CVE-2026-34993 | < 3.14.0 | AIOHTTP Vulnerable to Deserialization of Untrusted Data | HIGH 7.3 | 0.2 % | ||
| CVE-2026-34525 | < 3.13.4 | AIOHTTP: Duplicate Host header accepted | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-34520 | < 3.13.4 | AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass | LOW 2.7 | 0.5 % | ||
| CVE-2026-34519 | < 3.13.4 | AIOHTTP: HTTP response splitting via \r in reason phrase | LOW 2.7 | 0.3 % | ||
| CVE-2026-34518 | < 3.13.4 | AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect | LOW 2.7 | 0.3 % | ||
| CVE-2026-34517 | < 3.13.4 | AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS | LOW 2.7 | 0.4 % | ||
| CVE-2026-34516 | < 3.13.4 | AIOHTTP: Multipart Header Size Bypass | MEDIUM 6.6 | 0.4 % | ||
| CVE-2026-34515 | < 3.13.4 | AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows | MEDIUM 6.6 | 0.4 % | ||
| CVE-2026-34514 | < 3.13.4 | AIOHTTP: CRLF injection in multipart part content type header construction | LOW 2.7 | 0.3 % | ||
| CVE-2026-22815 | < 3.13.4 | AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-34513 | < 3.13.4 | AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector | LOW 2.7 | 0.4 % | ||
| CVE-2025-69230 | < 3.13.3 | AIOHTTP Vulnerable to Cookie Parser Warning Storm | LOW 2.7 | 0.4 % | ||
| CVE-2025-69229 | < 3.13.3 | AIOHTTP vulnerable to DoS through chunked messages | MEDIUM 6.6 | 0.4 % | ||
| CVE-2025-69228 | < 3.13.3 | AIOHTTP vulnerable to denial of service through large payloads | MEDIUM 6.6 | 0.4 % | ||
| CVE-2025-69227 | < 3.13.3 | AIOHTTP vulnerable to DoS when bypassing asserts | MEDIUM 6.6 | 0.4 % | ||
| CVE-2025-69225 | < 3.13.3 | AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields | LOW 2.7 | 0.3 % | ||
| CVE-2025-69226 | < 3.13.3 | AIOHTTP allows for a brute-force leak of internal static filepath components | MEDIUM 6.3 | 0.4 % | ||
| CVE-2025-69224 | < 3.13.3 | AIOHTTP's Unicode processing of header values could cause parsing discrepancies | MEDIUM 6.3 | 0.3 % | ||
| CVE-2025-69223 | < 3.13.3 | AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb | HIGH 7.5 | 0.6 % | ||
| CVE-2025-53643 | < 3.12.14 | AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections | LOW 1.7 | 0.4 % | ||
| CVE-2024-52304 | < 3.10.11 | aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions | MEDIUM 6.3 | 0.6 % | ||
| CVE-2024-52303 | >= 3.10.6, < 3.10.11 | aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method | HIGH 8.7 | 0.6 % | ||
| CVE-2024-42367 | >= 3.10.0b1, < 3.10.2 | In aiohttp, compressed files as symlinks are not protected from path traversal | MEDIUM 4.8 | 0.7 % | ||
| CVE-2024-30251 | < 3.9.4 | Denial of service when trying to parse malformed POST requests in aiohttp | HIGH 7.5 | 1.1 % | ||
| CVE-2024-27306 | < 3.9.4 | aiohttp vulnerable to XSS on index pages for static file handling | MEDIUM 6.1 | 0.7 % | ||
| CVE-2024-23334 | < 3.9.2 | aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal | HIGH 7.5 | 77 % | ||
| CVE-2024-23829 | < 3.9.2 | aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-49081 | < 3.9.0 | aiohttp's ClientSession is vulnerable to CRLF injection via version | HIGH 7.2 | 0.9 % | ||
| CVE-2023-49082 | < 3.9.0 | aiohttp's ClientSession is vulnerable to CRLF injection via method | MEDIUM 5.3 | 0.9 % | ||
| CVE-2023-47627 | < 3.8.6 | Request smuggling in aiohttp | HIGH 7.5 | 0.9 % | ||
| CVE-2023-47641 | < 3.8.0 | Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp | MEDIUM 6.5 | 0.8 % | ||
| CVE-2023-37276 | < 3.8.5 | aiohttp vulnerable to HTTP request smuggling | HIGH 7.5 | 1.3 % | ||
| CVE-2021-21330 | < 3.7.4 | Open redirect vulnerability in aiohttp | MEDIUM 6.1 | 1.9 % |