AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass

AIOHTTP: File descriptor exhaustion in multipart requests

aiohttp server lacks an initial request/header timeout

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

AIOHTTP: Incomplete websocket frame payloads bypass memory limits

AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

AIOHTTP: CRLF injection in multipart headers

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

AIOHTTP: Multipart Header Size Bypass

AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

AIOHTTP Vulnerable to Deserialization of Untrusted Data

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

AIOHTTP: Connector pool exhaustion via Max-Age overflow

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

AIOHTTP: Pure-Python parser request smuggling

AIOHTTP: Absolute-form request targets can spoof Request.scheme

AIOHTTP: Secure attribute not enforced for shared cookie

AIOHTTP: HTTP request smuggling via WebSocket upgrade

AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

AIOHTTP: Duplicate Host header accepted

AIOHTTP: HTTP response splitting via \r in reason phrase

AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS

AIOHTTP: CRLF injection in multipart part content type header construction

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies