AI
Vendor
aio-libs
43
CVEs
0
On KEV
8
New 30D
Products
AI9.1
aiohttp
aio-libs
39 CVEs0 on KEV7 new
MU5.3
multidict
aio-libs
1 CVEs0 on KEV1 new
AS6.5
Aiohttp Session
Aio-libs
2 CVEs0 on KEV0 new
AI5.3
Aiosmtpd
Aio-libs
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111750 | AI aiohttp aio-libs | 6.3 | Oct 19 | AIOHTTP: Pure-Python parser request smuggling |
| CVE-2026-111749 | AI aiohttp aio-libs | 2.3 | Oct 19 | AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies |
| CVE-2026-111748 | AI aiohttp aio-libs | 6.3 | Oct 19 | AIOHTTP: Absolute-form request targets can spoof Request.scheme |
| CVE-2026-111066 | AI aiohttp aio-libs | 8.2 | Oct 19 | AIOHTTP: File descriptor exhaustion in multipart requests |
| CVE-2026-111065 | AI aiohttp aio-libs | 6.9 | Oct 19 | AIOHTTP: Connector pool exhaustion via Max-Age overflow |
| CVE-2026-111064 | AI aiohttp aio-libs | 8.2 | Oct 19 | aiohttp server lacks an initial request/header timeout |
| CVE-2026-111063 | AI aiohttp aio-libs | 6.3 | Oct 19 | AIOHTTP: Secure attribute not enforced for shared cookie |
| CVE-2026-104874 | MU multidict aio-libs | 5.3 | Oct 2 | Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction |
| CVE-2026-69244 | AI aiohttp aio-libs | 7.1 | Aug 3 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) |
| CVE-2026-69243 | AI aiohttp aio-libs | 6.3 | Aug 3 | AIOHTTP: HTTP request smuggling via WebSocket upgrade |
| CVE-2026-59881 | AI aiohttp aio-libs | 6.9 | Jul 30 | AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate |
| CVE-2026-54273 | AI aiohttp aio-libs | 7.5 | Jun 22 | AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit |
| CVE-2026-54280 | AI aiohttp aio-libs | 7.5 | Jun 22 | AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect |
| CVE-2026-54278 | AI aiohttp aio-libs | 7.5 | Jun 22 | AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup |
| CVE-2026-54277 | AI aiohttp aio-libs | 7.5 | Jun 22 | AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines |
| CVE-2026-54276 | AI aiohttp aio-libs | 6.1 | Jun 22 | AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges |
| CVE-2026-54275 | AI aiohttp aio-libs | 7.5 | Jun 22 | AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections |
| CVE-2026-54274 | AI aiohttp aio-libs | 7.5 | Jun 22 | AIOHTTP: Incomplete websocket frame payloads bypass memory limits |
| CVE-2026-54279 | AI aiohttp aio-libs | 7.5 | Jun 22 | AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence |
| CVE-2026-50269 | AI aiohttp aio-libs | 7.5 | Jun 22 | AIOHTTP: CRLF injection in multipart headers |
| CVE-2026-47265 | AI aiohttp aio-libs | 7.5 | Jun 2 | AIOHTTP vulnerable to cross-origin redirect with per-request cookies |
| CVE-2026-34993 | AI aiohttp aio-libs | 7.3 | Jun 2 | AIOHTTP Vulnerable to Deserialization of Untrusted Data |
| CVE-2026-34525 | AI aiohttp aio-libs | 5.3 | Apr 1 | AIOHTTP: Duplicate Host header accepted |
| CVE-2026-34520 | AI aiohttp aio-libs | 9.1 | Apr 1 | AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass |
| CVE-2026-34519 | AI aiohttp aio-libs | 5.3 | Apr 1 | AIOHTTP: HTTP response splitting via \r in reason phrase |
| CVE-2026-34518 | AI aiohttp aio-libs | 5.3 | Apr 1 | AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect |
| CVE-2026-34517 | AI aiohttp aio-libs | 5.3 | Apr 1 | AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS |
| CVE-2026-34516 | AI aiohttp aio-libs | 7.5 | Apr 1 | AIOHTTP: Multipart Header Size Bypass |
| CVE-2026-34515 | AI aiohttp aio-libs | 7.5 | Apr 1 | AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows |
| CVE-2026-34514 | AI aiohttp aio-libs | 5.3 | Apr 1 | AIOHTTP: CRLF injection in multipart part content type header construction |
| CVE-2026-22815 | AI aiohttp aio-libs | 7.5 | Apr 1 | AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers |
| CVE-2026-34513 | AI aiohttp aio-libs | 7.5 | Apr 1 | AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector |
| CVE-2025-69230 | AI aiohttp aio-libs | 5.3 | Jan 5 | AIOHTTP Vulnerable to Cookie Parser Warning Storm |
| CVE-2025-69229 | AI aiohttp aio-libs | 5.3 | Jan 5 | AIOHTTP vulnerable to DoS through chunked messages |
| CVE-2025-69228 | AI aiohttp aio-libs | 7.5 | Jan 5 | AIOHTTP vulnerable to denial of service through large payloads |
| CVE-2025-69227 | AI aiohttp aio-libs | 7.5 | Jan 5 | AIOHTTP vulnerable to DoS when bypassing asserts |
| CVE-2025-69225 | AI aiohttp aio-libs | 5.3 | Jan 5 | AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields |
| CVE-2025-69226 | AI aiohttp aio-libs | 5.3 | Jan 5 | AIOHTTP allows for a brute-force leak of internal static filepath components |
| CVE-2025-69224 | AI aiohttp aio-libs | 6.5 | Jan 5 | AIOHTTP's Unicode processing of header values could cause parsing discrepancies |
| CVE-2025-69223 | AI aiohttp aio-libs | 7.5 | Jan 5 | AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb |
| CVE-2024-27305 | AI Aiosmtpd Aio-libs | 5.3 | Mar 12 | aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio |
| CVE-2018-1000814 | AS Aiohttp Session Aio-libs | 6.5 | Dec 20 | aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions… |
| CVE-2018-1000519 | AS Aiohttp Session Aio-libs | 6.5 | Jun 26 | aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see:… |