AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

AIOHTTP: Incomplete websocket frame payloads bypass memory limits

AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

AIOHTTP: CRLF injection in multipart headers

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

AIOHTTP: Multipart Header Size Bypass

AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

AIOHTTP vulnerable to denial of service through large payloads

AIOHTTP vulnerable to DoS when bypassing asserts

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method

Denial of service when trying to parse malformed POST requests in aiohttp

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

Request smuggling in aiohttp

aiohttp vulnerable to HTTP request smuggling

AIOHTTP Vulnerable to Deserialization of Untrusted Data

AIOHTTP's Unicode processing of header values could cause parsing discrepancies

aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp

AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

aiohttp vulnerable to XSS on index pages for static file handling

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python

AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS)

AIOHTTP: Duplicate Host header accepted

AIOHTTP: HTTP response splitting via \r in reason phrase

AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS

AIOHTTP: CRLF injection in multipart part content type header construction

AIOHTTP Vulnerable to Cookie Parser Warning Storm

AIOHTTP vulnerable to DoS through chunked messages

AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields

AIOHTTP allows for a brute-force leak of internal static filepath components

aiohttp's ClientSession is vulnerable to CRLF injection via version

aiohttp's ClientSession is vulnerable to CRLF injection via method

In aiohttp, compressed files as symlinks are not protected from path traversal