PyPI / aiohttp

aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

Modified: 2/4/2026

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Modified: 6/15/2026

AIOHTTP has CRLF injection through multipart part content type header construction

Modified: 4/6/2026

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

Modified: 4/2/2026

aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser

Modified: 9/3/2024

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

Modified: 6/15/2026

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Modified: 6/15/2026

AIOHTTP vulnerable to brute-force leak of internal static file path components

Modified: 2/4/2026

aiohttp is vulnerable to directory traversal

Modified: 2/4/2026

aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests

Modified: 2/4/2026

AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

Modified: 4/6/2026

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

Modified: 6/15/2026

AIOHTTP's unicode processing of header values could cause parsing discrepancies

Modified: 2/4/2026

AIOHTTP vulnerable to denial of service through large payloads

Modified: 2/4/2026

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Modified: 2/4/2026

aiohttp Cross-site Scripting vulnerability on index pages for static file handling

Modified: 2/4/2026

aiohttp allows request smuggling due to incorrect parsing of chunk extensions

Modified: 2/4/2026

aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

Modified: 2/4/2026

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

Modified: 2/4/2026

AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

Modified: 5/5/2026

aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

Modified: 6/15/2026

AIOHTTP accepts duplicate Host headers

Modified: 4/2/2026

AIOHTTP Vulnerable to Cookie Parser Warning Storm

Modified: 2/4/2026

aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

Modified: 6/15/2026

AIOHTTP vulnerable to DoS through chunked messages

Modified: 2/4/2026

AIOHTTP has problems in HTTP parser (the python one, not llhttp)

Modified: 2/4/2026

AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

Modified: 4/6/2026

AIOHTTP is vulnerable to cross-origin redirect with per-request cookies

Modified: 6/4/2026

aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

Modified: 6/15/2026

AIOHTTP is Vulnerable to Deserialization of Untrusted Data

Modified: 6/4/2026

AIOHTTP vulnerable to DoS when bypassing asserts

Modified: 2/4/2026

In aiohttp, compressed files as symlinks are not protected from path traversal

Modified: 2/4/2026

AIOHTTP has a Multipart Header Size Bypass

Modified: 4/6/2026

aiohttp: CRLF injection in multipart headers

Modified: 6/15/2026

AIOHTTP has unicode match groups in regexes for ASCII protocol elements

Modified: 2/4/2026

AIOHTTP has HTTP response splitting via \r in reason phrase

Modified: 4/2/2026

AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

Modified: 4/6/2026

aiohttp has vulnerable dependency that is vulnerable to request smuggling

Modified: 2/4/2026

aiohttp's ClientSession is vulnerable to CRLF injection via version

Modified: 2/4/2026

aiohttp's ClientSession is vulnerable to CRLF injection via method

Modified: 2/4/2026

`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)

Modified: 3/13/2026

aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage

Modified: 4/6/2026

aiohttp: Incomplete websocket frame payloads bypass memory limits

Modified: 6/15/2026

Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks

Modified: 11/3/2025

Modified: 11/8/2023

aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser

Modified: 11/8/2023

Modified: 11/22/2023

Modified: 11/22/2023

Modified: 1/29/2024

Modified: 1/29/2024

Modified: 2/5/2024

Modified: 2/6/2024