aiohttp vulnerabilities
CVEs whose affected-version data names the aiohttp package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
44 CVEsRSS
CVE-2026-111065Medium· 6.9AIOHTTP: Connector pool exhaustion via Max-Age overflow
AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111748Medium· 6.3AIOHTTP: Absolute-form request targets can spoof Request.scheme
AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-111750Medium· 6.3AIOHTTP: Pure-Python parser request smuggling
AIOHTTP: Pure-Python parser request smuggling
CVE-2026-111749Low· 2.3AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequent…
GHSA-2g87-pp6c-29x5Highaiohttp: Multiple instances of excessive or unbounded memory/CPU use
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
CVE-2026-111063Medium· 6.3AIOHTTP: Secure attribute not enforced for shared cookie
AIOHTTP: Secure attribute not enforced for shared cookie
CVE-2026-54276Medium· 6.1AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vuln…
CVE-2026-54280High· 7.5⚖ disputedAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar…
CVE-2026-50269Lowaiohttp: CRLF injection in multipart headers
aiohttp: CRLF injection in multipart headers
CVE-2026-54279Lowaiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
CVE-2026-54277Mediumaiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
CVE-2026-54278Mediumaiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
CVE-2026-54273Mediumaiohttp: HTTP/1 Pipelined Requests Queue Without Limit
aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
CVE-2026-54275Lowaiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
CVE-2026-54274Mediumaiohttp: Incomplete websocket frame payloads bypass memory limits
aiohttp: Incomplete websocket frame payloads bypass memory limits
CVE-2026-47265MediumAIOHTTP is vulnerable to cross-origin redirect with per-request cookies
AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
CVE-2026-34515MediumAIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
CVE-2026-34519LowAIOHTTP has HTTP response splitting via \r in reason phrase
AIOHTTP has HTTP response splitting via \r in reason phrase
CVE-2026-34516High· 7.5AIOHTTP has a Multipart Header Size Bypass
AIOHTTP has a Multipart Header Size Bypass
CVE-2026-34513LowAIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector
AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector
CVE-2026-34525MediumAIOHTTP accepts duplicate Host headers
AIOHTTP accepts duplicate Host headers
CVE-2026-34518Medium· 5.3AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect
AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect
CVE-2026-34520Critical· 9.1AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass
AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass
CVE-2026-34517LowAIOHTTP has late size enforcement for non-file multipart fields causes memory DoS
AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS
CVE-2026-34514LowAIOHTTP has CRLF injection through multipart part content type header construction
AIOHTTP has CRLF injection through multipart part content type header construction
CVE-2025-69225Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the …
CVE-2025-69227High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If …
CVE-2025-69229Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an applicat…
CVE-2025-69230Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an a…
CVE-2025-69228High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an applic…