aiohttp (PyPI)
Advisories
103
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.14.4 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "aiohttp>=3.14.4"poetry
poetry add "aiohttp>=3.14.4"uv
uv add "aiohttp>=3.14.4"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-pqxq-w44r-73xw AIOHTTP: Pure-Python parser request smuggling |
Medium EPSS 0.38% |
< 3.14.4 | 3.14.4 |
| GHSA-gx76-c99x-2c96 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies |
Low EPSS 0.38% |
< 3.14.4 | 3.14.4 |
| GHSA-f9xw-jh8m-3mwq AIOHTTP: Absolute-form request targets can spoof Request.scheme |
Medium EPSS 0.39% |
< 3.14.4 | 3.14.4 |
| GHSA-9xw5-w5jj-pvcg AIOHTTP: File descriptor exhaustion in multipart requests |
High EPSS 0.41% |
>= 2.0.0, < 3.14.4 | 3.14.4 |
| GHSA-6cjc-53gc-5rqm AIOHTTP: Connector pool exhaustion via Max-Age overflow |
Medium EPSS 0.40% |
< 3.14.4 | 3.14.4 |
| GHSA-5wr8-gcqf-gqf3 aiohttp server lacks an initial request/header timeout |
High EPSS 0.40% |
< 3.14.4 | 3.14.4 |
| GHSA-494j-54xm-rwp3 AIOHTTP: Secure attribute not enforced for shared cookie |
Medium EPSS 0.23% |
< 3.14.4 | 3.14.4 |
| GHSA-2g87-pp6c-29x5 aiohttp: Multiple instances of excessive or unbounded memory/CPU use |
High | < 3.14.4 | 3.14.4 |
| GHSA-cq5v-8q36-5273 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) |
High EPSS 0.53% |
< 3.14.3 | 3.14.3 |
| GHSA-cq5v-8q36-5273 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) |
High EPSS 0.53% |
< 3.14.3 | 3.14.3 |
| GHSA-mfx4-hv73-q22v AIOHTTP: HTTP request smuggling via WebSocket upgrade |
Medium EPSS 0.44% |
< 3.14.2 | 3.14.2 |
| GHSA-mfx4-hv73-q22v AIOHTTP: HTTP request smuggling via WebSocket upgrade |
Medium EPSS 0.44% |
< 3.14.2 | 3.14.2 |
| GHSA-mq44-7p77-q5h7 AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate |
Medium EPSS 0.52% |
< 3.14.2 | 3.14.2 |
| GHSA-mq44-7p77-q5h7 AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate |
Medium EPSS 0.52% |
< 3.14.2 | 3.14.2 |
| GHSA-xcgm-r5h9-7989 aiohttp: Incomplete websocket frame payloads bypass memory limits |
High EPSS 0.54% |
< 3.14.1 | 3.14.1 |
| GHSA-xcgm-r5h9-7989 aiohttp: Incomplete websocket frame payloads bypass memory limits |
High EPSS 0.54% |
< 3.14.1 | 3.14.1 |
| GHSA-4m7w-qmgq-4wj5 aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections |
High EPSS 0.47% |
< 3.14.1 | 3.14.1 |
| GHSA-4m7w-qmgq-4wj5 aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections |
High EPSS 0.47% |
< 3.14.1 | 3.14.1 |
| GHSA-9x8q-7h8h-wcw9 aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect |
High EPSS 0.46% |
< 3.14.1 | 3.14.1 |
| GHSA-9x8q-7h8h-wcw9 aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect |
High EPSS 0.46% |
< 3.14.1 | 3.14.1 |
| GHSA-4fvr-rgm6-gqmc aiohttp: HTTP/1 Pipelined Requests Queue Without Limit |
High EPSS 0.49% |
< 3.14.1 | 3.14.1 |
| GHSA-4fvr-rgm6-gqmc aiohttp: HTTP/1 Pipelined Requests Queue Without Limit |
High EPSS 0.49% |
< 3.14.1 | 3.14.1 |
| GHSA-g3cq-j2xw-wf74 aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup |
High EPSS 0.49% |
< 3.14.1 | 3.14.1 |
| GHSA-g3cq-j2xw-wf74 aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup |
High EPSS 0.49% |
< 3.14.1 | 3.14.1 |
| GHSA-63hw-fmq6-xxg2 aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines |
High EPSS 0.56% |
< 3.14.1 | 3.14.1 |
| GHSA-63hw-fmq6-xxg2 aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines |
High EPSS 0.56% |
< 3.14.1 | 3.14.1 |
| GHSA-hpj7-wq8m-9hgp aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges |
Medium EPSS 0.31% |
< 3.14.1 | 3.14.1 |
| GHSA-hpj7-wq8m-9hgp aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges |
Medium EPSS 0.31% |
< 3.14.1 | 3.14.1 |
| GHSA-2fqr-mr3j-6wp8 aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence |
High EPSS 0.49% |
< 3.14.1 | 3.14.1 |
| GHSA-2fqr-mr3j-6wp8 aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence |
High EPSS 0.49% |
< 3.14.1 | 3.14.1 |
| GHSA-m6qw-4cw2-hm4m aiohttp: CRLF injection in multipart headers |
High EPSS 0.53% |
< 3.14.0 | 3.14.0 |
| GHSA-m6qw-4cw2-hm4m aiohttp: CRLF injection in multipart headers |
High EPSS 0.53% |
< 3.14.0 | 3.14.0 |
| GHSA-hg6j-4rv6-33pg AIOHTTP is vulnerable to cross-origin redirect with per-request cookies |
High EPSS 0.15% |
< 3.14.0 | 3.14.0 |
| GHSA-hg6j-4rv6-33pg AIOHTTP is vulnerable to cross-origin redirect with per-request cookies |
High EPSS 0.15% |
< 3.14.0 | 3.14.0 |
| GHSA-jg22-mg44-37j8 AIOHTTP is Vulnerable to Deserialization of Untrusted Data |
High EPSS 0.18% |
< 3.14.0 | 3.14.0 |
| GHSA-jg22-mg44-37j8 AIOHTTP is Vulnerable to Deserialization of Untrusted Data |
High EPSS 0.18% |
< 3.14.0 | 3.14.0 |
| GHSA-c427-h43c-vf67 AIOHTTP accepts duplicate Host headers |
Medium EPSS 0.30% |
< 3.13.4 | 3.13.4 |
| GHSA-c427-h43c-vf67 AIOHTTP accepts duplicate Host headers |
Medium EPSS 0.30% |
< 3.13.4 | 3.13.4 |
| GHSA-63hf-3vf5-4wqf AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass |
Critical EPSS 0.48% |
< 3.13.4 | 3.13.4 |
| GHSA-63hf-3vf5-4wqf AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass |
Critical EPSS 0.48% |
< 3.13.4 | 3.13.4 |
| GHSA-mwh4-6h8g-pg8w AIOHTTP has HTTP response splitting via \r in reason phrase |
Medium EPSS 0.30% |
< 3.13.4 | 3.13.4 |
| GHSA-mwh4-6h8g-pg8w AIOHTTP has HTTP response splitting via \r in reason phrase |
Medium EPSS 0.30% |
< 3.13.4 | 3.13.4 |
| GHSA-966j-vmvw-g2g9 AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect |
Medium EPSS 0.35% |
< 3.13.4 | 3.13.4 |
| GHSA-966j-vmvw-g2g9 AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect |
Medium EPSS 0.35% |
< 3.13.4 | 3.13.4 |
| GHSA-3wq7-rqq7-wx6j AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS |
Medium EPSS 0.40% |
< 3.13.4 | 3.13.4 |
| GHSA-3wq7-rqq7-wx6j AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS |
Medium EPSS 0.40% |
< 3.13.4 | 3.13.4 |
| GHSA-m5qp-6w8w-w647 AIOHTTP has a Multipart Header Size Bypass |
High EPSS 0.46% |
< 3.13.4 | 3.13.4 |
| GHSA-m5qp-6w8w-w647 AIOHTTP has a Multipart Header Size Bypass |
High EPSS 0.46% |
< 3.13.4 | 3.13.4 |
| GHSA-p998-jp59-783m AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows |
High EPSS 0.45% |
< 3.13.4 | 3.13.4 |
| GHSA-p998-jp59-783m AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows |
High EPSS 0.45% |
< 3.13.4 | 3.13.4 |
| GHSA-2vrm-gr82-f7m5 AIOHTTP has CRLF injection through multipart part content type header construction |
Medium EPSS 0.33% |
< 3.13.4 | 3.13.4 |
| GHSA-2vrm-gr82-f7m5 AIOHTTP has CRLF injection through multipart part content type header construction |
Medium EPSS 0.33% |
< 3.13.4 | 3.13.4 |
| GHSA-hcc4-c3v8-rx92 AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector |
High EPSS 0.46% |
< 3.13.4 | 3.13.4 |
| GHSA-hcc4-c3v8-rx92 AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector |
High EPSS 0.46% |
< 3.13.4 | 3.13.4 |
| GHSA-w2fm-2cpv-w7v5 aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage |
High EPSS 0.46% |
< 3.13.4 | 3.13.4 |
| GHSA-w2fm-2cpv-w7v5 aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage |
High EPSS 0.46% |
< 3.13.4 | 3.13.4 |
| GHSA-fh55-r93g-j68g AIOHTTP Vulnerable to Cookie Parser Warning Storm |
Medium EPSS 0.36% |
< 3.13.3 | 3.13.3 |
| GHSA-fh55-r93g-j68g AIOHTTP Vulnerable to Cookie Parser Warning Storm |
Medium EPSS 0.36% |
< 3.13.3 | 3.13.3 |
| GHSA-g84x-mcqj-x9qq AIOHTTP vulnerable to DoS through chunked messages |
Medium EPSS 0.40% |
< 3.13.3 | 3.13.3 |
| GHSA-g84x-mcqj-x9qq AIOHTTP vulnerable to DoS through chunked messages |
Medium EPSS 0.40% |
< 3.13.3 | 3.13.3 |
| GHSA-6jhg-hg63-jvvf AIOHTTP vulnerable to denial of service through large payloads |
High EPSS 0.41% |
< 3.13.3 | 3.13.3 |
| GHSA-6jhg-hg63-jvvf AIOHTTP vulnerable to denial of service through large payloads |
High EPSS 0.41% |
< 3.13.3 | 3.13.3 |
| GHSA-jj3x-wxrx-4x23 AIOHTTP vulnerable to DoS when bypassing asserts |
High EPSS 0.40% |
< 3.13.3 | 3.13.3 |
| GHSA-jj3x-wxrx-4x23 AIOHTTP vulnerable to DoS when bypassing asserts |
High EPSS 0.40% |
< 3.13.3 | 3.13.3 |
| GHSA-54jq-c3m8-4m76 AIOHTTP vulnerable to brute-force leak of internal static file path components |
Medium EPSS 0.37% |
< 3.13.3 | 3.13.3 |
| GHSA-54jq-c3m8-4m76 AIOHTTP vulnerable to brute-force leak of internal static file path components |
Medium EPSS 0.37% |
< 3.13.3 | 3.13.3 |
| GHSA-mqqc-3gqh-h2x8 AIOHTTP has unicode match groups in regexes for ASCII protocol elements |
Medium EPSS 0.28% |
< 3.13.3 | 3.13.3 |
| GHSA-mqqc-3gqh-h2x8 AIOHTTP has unicode match groups in regexes for ASCII protocol elements |
Medium EPSS 0.28% |
< 3.13.3 | 3.13.3 |
| GHSA-69f9-5gxw-wvc2 AIOHTTP's unicode processing of header values could cause parsing discrepancies |
Medium EPSS 0.25% |
< 3.13.3 | 3.13.3 |
| GHSA-69f9-5gxw-wvc2 AIOHTTP's unicode processing of header values could cause parsing discrepancies |
Medium EPSS 0.25% |
< 3.13.3 | 3.13.3 |
| GHSA-6mq8-rvhq-8wgg AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb |
High EPSS 0.58% |
< 3.13.3 | 3.13.3 |
| GHSA-6mq8-rvhq-8wgg AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb |
High EPSS 0.58% |
< 3.13.3 | 3.13.3 |
| GHSA-9548-qrrj-x5pj AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections |
High EPSS 0.36% |
< 3.12.14 | 3.12.14 |
| GHSA-9548-qrrj-x5pj AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections |
High EPSS 0.36% |
< 3.12.14 | 3.12.14 |
| GHSA-8495-4g3g-x7pr aiohttp allows request smuggling due to incorrect parsing of chunk extensions |
High EPSS 0.56% |
< 3.10.11 | 3.10.11 |
| GHSA-8495-4g3g-x7pr aiohttp allows request smuggling due to incorrect parsing of chunk extensions |
High EPSS 0.56% |
< 3.10.11 | 3.10.11 |
| GHSA-27mf-ghqm-j3j8 aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method |
High EPSS 0.59% |
>= 3.10.6, < 3.10.11 | 3.10.11 |
| GHSA-27mf-ghqm-j3j8 aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method |
High EPSS 0.59% |
>= 3.10.6, < 3.10.11 | 3.10.11 |
| GHSA-jwhx-xcg6-8xhj In aiohttp, compressed files as symlinks are not protected from path traversal |
Medium EPSS 0.65% |
>= 3.10.0b1, < 3.10.2 | 3.10.2 |
| GHSA-jwhx-xcg6-8xhj In aiohttp, compressed files as symlinks are not protected from path traversal |
Medium EPSS 0.65% |
>= 3.10.0b1, < 3.10.2 | 3.10.2 |
| GHSA-5m98-qgg9-wh84 aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests |
High EPSS 1.09% |
< 3.9.4 | 3.9.4 |
| GHSA-5m98-qgg9-wh84 aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests |
High EPSS 1.09% |
< 3.9.4 | 3.9.4 |
| GHSA-7gpw-8wmc-pm8g aiohttp Cross-site Scripting vulnerability on index pages for static file handling |
Medium EPSS 0.67% |
< 3.9.4 | 3.9.4 |
| GHSA-7gpw-8wmc-pm8g aiohttp Cross-site Scripting vulnerability on index pages for static file handling |
Medium EPSS 0.67% |
< 3.9.4 | 3.9.4 |
| GHSA-5h86-8mv2-jq9f aiohttp is vulnerable to directory traversal |
High EPSS 76.88% |
>= 1.0.5, < 3.9.2 | 3.9.2 |
| GHSA-5h86-8mv2-jq9f aiohttp is vulnerable to directory traversal |
High EPSS 76.88% |
>= 1.0.5, < 3.9.2 | 3.9.2 |
| GHSA-8qpw-xqxj-h4r2 aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators |
Medium EPSS 1.03% |
< 3.9.2 | 3.9.2 |
| GHSA-8qpw-xqxj-h4r2 aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators |
Medium EPSS 1.03% |
< 3.9.2 | 3.9.2 |
| GHSA-q3qx-c6g2-7pw2 aiohttp's ClientSession is vulnerable to CRLF injection via version |
Medium EPSS 0.88% |
< 3.9.0 | 3.9.0 |
| GHSA-q3qx-c6g2-7pw2 aiohttp's ClientSession is vulnerable to CRLF injection via version |
Medium EPSS 0.88% |
< 3.9.0 | 3.9.0 |
| GHSA-qvrw-v9rv-5rjx aiohttp's ClientSession is vulnerable to CRLF injection via method |
Medium EPSS 0.95% |
< 3.9.0 | 3.9.0 |
| GHSA-qvrw-v9rv-5rjx aiohttp's ClientSession is vulnerable to CRLF injection via method |
Medium EPSS 0.95% |
< 3.9.0 | 3.9.0 |
| GHSA-pjjw-qhg8-p2p9 aiohttp has vulnerable dependency that is vulnerable to request smuggling |
Medium | < 3.8.6 | 3.8.6 |
| GHSA-gfw2-4jvh-wgfg AIOHTTP has problems in HTTP parser (the python one, not llhttp) |
High EPSS 0.86% |
< 3.8.6 | 3.8.6 |
| GHSA-gfw2-4jvh-wgfg AIOHTTP has problems in HTTP parser (the python one, not llhttp) |
High EPSS 0.86% |
< 3.8.6 | 3.8.6 |
| GHSA-xx9p-xxvh-7g8j Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks |
Medium EPSS 0.83% |
< 3.8.0 | 3.8.0 |
| GHSA-xx9p-xxvh-7g8j Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks |
Medium EPSS 0.83% |
< 3.8.0 | 3.8.0 |
| GHSA-45c4-8wx5-qw6w aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser |
Medium EPSS 1.34% |
< 3.8.5 | 3.8.5 |
| GHSA-45c4-8wx5-qw6w aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser |
Medium EPSS 1.34% |
< 3.8.5 | 3.8.5 |
| GHSA-rwqr-c348-m5wr Withdrawn: Denial of Service in aiohttp Withdrawn |
Medium EPSS 0.72% |
<= 3.8.1 | No fix yet |
| GHSA-rwqr-c348-m5wr Withdrawn: Denial of Service in aiohttp Withdrawn |
Medium EPSS 0.72% |
all versions | No fix yet |
| GHSA-v6wp-4m6f-gcjg `aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware) |
Low EPSS 1.91% |
< 3.7.4 | 3.7.4 |
| GHSA-v6wp-4m6f-gcjg `aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware) |
Low EPSS 1.91% |
< 3.7.4 | 3.7.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor