AI
Vendor
Aiohttp
45
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-54273 | AI Aiohttp Aiohttp | 7.5 | Jun 22 | AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit |
| CVE-2026-54280 | AI Aiohttp Aiohttp | 7.5 | Jun 22 | AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect |
| CVE-2026-54278 | AI Aiohttp Aiohttp | 7.5 | Jun 22 | AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup |
| CVE-2026-54277 | AI Aiohttp Aiohttp | 7.5 | Jun 22 | AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines |
| CVE-2026-54276 | AI Aiohttp Aiohttp | 6.1 | Jun 22 | AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges |
| CVE-2026-54275 | AI Aiohttp Aiohttp | 7.5 | Jun 22 | AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections |
| CVE-2026-54274 | AI Aiohttp Aiohttp | 7.5 | Jun 22 | AIOHTTP: Incomplete websocket frame payloads bypass memory limits |
| CVE-2026-54279 | AI Aiohttp Aiohttp | 7.5 | Jun 22 | AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence |
| CVE-2026-50269 | AI Aiohttp Aiohttp | 7.5 | Jun 22 | AIOHTTP: CRLF injection in multipart headers |
| CVE-2026-47265 | AI Aiohttp Aiohttp | 7.5 | Jun 2 | AIOHTTP vulnerable to cross-origin redirect with per-request cookies |
| CVE-2026-34993 | AI Aiohttp Aiohttp | 7.3 | Jun 2 | AIOHTTP Vulnerable to Deserialization of Untrusted Data |
| CVE-2026-34525 | AI Aiohttp Aiohttp | 5.3 | Apr 1 | AIOHTTP: Duplicate Host header accepted |
| CVE-2026-34520 | AI Aiohttp Aiohttp | 9.1 | Apr 1 | AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass |
| CVE-2026-34519 | AI Aiohttp Aiohttp | 5.3 | Apr 1 | AIOHTTP: HTTP response splitting via \r in reason phrase |
| CVE-2026-34518 | AI Aiohttp Aiohttp | 5.3 | Apr 1 | AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect |
| CVE-2026-34517 | AI Aiohttp Aiohttp | 5.3 | Apr 1 | AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS |
| CVE-2026-34516 | AI Aiohttp Aiohttp | 7.5 | Apr 1 | AIOHTTP: Multipart Header Size Bypass |
| CVE-2026-34515 | AI Aiohttp Aiohttp | 7.5 | Apr 1 | AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows |
| CVE-2026-34514 | AI Aiohttp Aiohttp | 5.3 | Apr 1 | AIOHTTP: CRLF injection in multipart part content type header construction |
| CVE-2026-22815 | AI Aiohttp Aiohttp | 7.5 | Apr 1 | AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers |
| CVE-2026-34513 | AI Aiohttp Aiohttp | 7.5 | Apr 1 | AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector |
| CVE-2025-69230 | AI Aiohttp Aiohttp | 5.3 | Jan 5 | AIOHTTP Vulnerable to Cookie Parser Warning Storm |
| CVE-2025-69229 | AI Aiohttp Aiohttp | 5.3 | Jan 5 | AIOHTTP vulnerable to DoS through chunked messages |
| CVE-2025-69228 | AI Aiohttp Aiohttp | 7.5 | Jan 5 | AIOHTTP vulnerable to denial of service through large payloads |
| CVE-2025-69227 | AI Aiohttp Aiohttp | 7.5 | Jan 5 | AIOHTTP vulnerable to DoS when bypassing asserts |
| CVE-2025-69225 | AI Aiohttp Aiohttp | 5.3 | Jan 5 | AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields |
| CVE-2025-69226 | AI Aiohttp Aiohttp | 5.3 | Jan 5 | AIOHTTP allows for a brute-force leak of internal static filepath components |
| CVE-2025-69224 | AI Aiohttp Aiohttp | 6.5 | Jan 5 | AIOHTTP's Unicode processing of header values could cause parsing discrepancies |
| CVE-2025-69223 | AI Aiohttp Aiohttp | 7.5 | Jan 5 | AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb |
| CVE-2025-53643 | AI Aiohttp Aiohttp | 7.5 | Jul 14 | AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections |
| CVE-2024-52304 | AI Aiohttp Aiohttp | 7.5 | Nov 18 | aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions |
| CVE-2024-52303 | AI Aiohttp Aiohttp | 7.5 | Nov 18 | aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method |
| CVE-2024-42367 | AI Aiohttp Aiohttp | 4.8 | Aug 9 | In aiohttp, compressed files as symlinks are not protected from path traversal |
| CVE-2024-30251 | AI Aiohttp Aiohttp | 7.5 | May 2 | Denial of service when trying to parse malformed POST requests in aiohttp |
| CVE-2024-27306 | AI Aiohttp Aiohttp | 6.1 | Apr 18 | aiohttp vulnerable to XSS on index pages for static file handling |
| CVE-2024-23334 | AI Aiohttp Aiohttp | 7.5 | Jan 29 | aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal |
| CVE-2024-23829 | AI Aiohttp Aiohttp | 6.5 | Jan 29 | aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators |
| CVE-2023-49081 | AI Aiohttp Aiohttp | 5.3 | Nov 30 | aiohttp's ClientSession is vulnerable to CRLF injection via version |
| CVE-2023-49082 | AI Aiohttp Aiohttp | 5.3 | Nov 29 | aiohttp's ClientSession is vulnerable to CRLF injection via method |
| CVE-2023-47627 | AI Aiohttp Aiohttp | 7.5 | Nov 14 | Request smuggling in aiohttp |
| CVE-2023-47641 | AI Aiohttp Aiohttp | 6.5 | Nov 14 | Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp |
| CVE-2023-37276 | AI Aiohttp Aiohttp | 7.5 | Jul 19 | aiohttp vulnerable to HTTP request smuggling |
| CVE-2022-33124 | AI Aiohttp Aiohttp | 5.5 | Jun 22 | AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS) |
| CVE-2021-21330 | AI Aiohttp Aiohttp | 6.1 | Feb 26 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python |