GHSA-pjjw-qhg8-p2p9Medium▾ Sunlitaiohttp has vulnerable dependency that is vulnerable to request smuggling
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
llhttp 8.1.1 is vulnerable to two request smuggling vulnerabilities. Details have not been disclosed yet, so refer to llhttp for future information. The issue is resolved by using llhttp 9+ (which is included in aiohttp 3.8.6+).
aiohttp < 3.8.6Upgrade to a patched release:
aiohttp 3.8.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111065Medium· 6.9AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111748Medium· 6.3AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-111749Low· 2.3AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
CVE-2026-111750Medium· 6.3AIOHTTP: Pure-Python parser request smuggling
GHSA-2g87-pp6c-29x5Highaiohttp: Multiple instances of excessive or unbounded memory/CPU use
CVE-2026-111063Medium· 6.3AIOHTTP: Secure attribute not enforced for shared cookie