HIGH7.5PyPI
GHSA-27mf-ghqm-j3j8· CVE-2024-52303, PYSEC-2026-1096aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method
Modified: 9/10/2026
package
PyPI/aiohttp
pkg:pypi/aiohttp
LOWPyPI
GHSA-2fqr-mr3j-6wp8· CVE-2026-54279, PYSEC-2026-2112aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
Modified: 9/10/2026
LOWPyPI
GHSA-2vrm-gr82-f7m5· CVE-2026-34514, PYSEC-2026-2096AIOHTTP has CRLF injection through multipart part content type header construction
Modified: 9/10/2026
LOWPyPI
GHSA-3wq7-rqq7-wx6j· CVE-2026-34517, PYSEC-2026-2099AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-45c4-8wx5-qw6w· CVE-2023-37276, PYSEC-2023-120aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser
Modified: 9/10/2026
MEDIUMPyPI
GHSA-4fvr-rgm6-gqmc· CVE-2026-54273, PYSEC-2026-2107aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
Modified: 9/10/2026
LOWPyPI
GHSA-4m7w-qmgq-4wj5· CVE-2026-54275, PYSEC-2026-237aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
Modified: 9/10/2026
LOWPyPI
GHSA-54jq-c3m8-4m76· CVE-2025-69226, PYSEC-2026-1097AIOHTTP vulnerable to brute-force leak of internal static file path components
Modified: 9/10/2026
MEDIUM5.9PyPI
GHSA-5h86-8mv2-jq9f· CVE-2024-23334, PYSEC-2024-24aiohttp is vulnerable to directory traversal
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-5m98-qgg9-wh84· CVE-2024-30251, PYSEC-2026-1098aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
Modified: 9/10/2026
CRITICAL9.1PyPI
GHSA-63hf-3vf5-4wqf· CVE-2026-34520, PYSEC-2026-2102AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass
Modified: 9/10/2026
MEDIUMPyPI
GHSA-63hw-fmq6-xxg2· CVE-2026-54277, PYSEC-2026-2110aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
Modified: 9/10/2026
LOWPyPI
GHSA-69f9-5gxw-wvc2· CVE-2025-69224, PYSEC-2026-1099AIOHTTP's unicode processing of header values could cause parsing discrepancies
Modified: 9/10/2026
MEDIUMPyPI
GHSA-6jhg-hg63-jvvf· CVE-2025-69228, PYSEC-2026-1100AIOHTTP vulnerable to denial of service through large payloads
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-6mq8-rvhq-8wgg· CVE-2025-69223, PYSEC-2026-1101AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Modified: 9/10/2026
MEDIUM6.1PyPI
GHSA-7gpw-8wmc-pm8g· CVE-2024-27306, PYSEC-2026-1102aiohttp Cross-site Scripting vulnerability on index pages for static file handling
Modified: 9/10/2026
MEDIUMPyPI
GHSA-8495-4g3g-x7pr· CVE-2024-52304, PYSEC-2026-1103aiohttp allows request smuggling due to incorrect parsing of chunk extensions
Modified: 9/10/2026
MEDIUM6.5PyPI
GHSA-8qpw-xqxj-h4r2· CVE-2024-23829, PYSEC-2024-26aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
Modified: 9/10/2026
LOWPyPI
GHSA-9548-qrrj-x5pj· CVE-2025-53643, PYSEC-2026-1104AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-966j-vmvw-g2g9· CVE-2026-34518, PYSEC-2026-2100AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect
Modified: 9/10/2026
LOWPyPI
GHSA-9x8q-7h8h-wcw9· CVE-2026-54280, PYSEC-2026-2113aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
Modified: 9/10/2026
MEDIUMPyPI
GHSA-c427-h43c-vf67· CVE-2026-34525, PYSEC-2026-2103AIOHTTP accepts duplicate Host headers
Modified: 9/10/2026
HIGHPyPI
GHSA-cq5v-8q36-5273· CVE-2026-69244, PYSEC-2026-3545AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
Modified: 9/10/2026
LOWPyPI
GHSA-fh55-r93g-j68g· CVE-2025-69230, PYSEC-2026-1105AIOHTTP Vulnerable to Cookie Parser Warning Storm
Modified: 9/10/2026
MEDIUMPyPI
GHSA-g3cq-j2xw-wf74· CVE-2026-54278, PYSEC-2026-2111aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
Modified: 9/10/2026
MEDIUMPyPI
GHSA-g84x-mcqj-x9qq· CVE-2025-69229, PYSEC-2026-1106AIOHTTP vulnerable to DoS through chunked messages
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-gfw2-4jvh-wgfg· CVE-2023-47627, PYSEC-2023-246AIOHTTP has problems in HTTP parser (the python one, not llhttp)
Modified: 9/10/2026
LOWPyPI
GHSA-hcc4-c3v8-rx92· CVE-2026-34513, PYSEC-2026-2095AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector
Modified: 9/10/2026
MEDIUMPyPI
GHSA-hg6j-4rv6-33pg· CVE-2026-47265, PYSEC-2026-2105AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
Modified: 9/10/2026
MEDIUMPyPI
GHSA-hpj7-wq8m-9hgp· CVE-2026-54276, PYSEC-2026-2109aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
Modified: 9/10/2026
MEDIUM6.4PyPI
GHSA-jg22-mg44-37j8· CVE-2026-34993, PYSEC-2026-2104AIOHTTP is Vulnerable to Deserialization of Untrusted Data
Modified: 9/10/2026
MEDIUMPyPI
GHSA-jj3x-wxrx-4x23· CVE-2025-69227, PYSEC-2026-1107AIOHTTP vulnerable to DoS when bypassing asserts
Modified: 9/10/2026
MEDIUM4.8PyPI
GHSA-jwhx-xcg6-8xhj· CVE-2024-42367, PYSEC-2026-1108In aiohttp, compressed files as symlinks are not protected from path traversal
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-m5qp-6w8w-w647· CVE-2026-34516, PYSEC-2026-2098AIOHTTP has a Multipart Header Size Bypass
Modified: 9/10/2026
LOWPyPI
GHSA-m6qw-4cw2-hm4m· CVE-2026-50269, PYSEC-2026-2106aiohttp: CRLF injection in multipart headers
Modified: 9/10/2026
MEDIUMPyPI
GHSA-mfx4-hv73-q22v· CVE-2026-69243, PYSEC-2026-3546AIOHTTP: HTTP request smuggling via WebSocket upgrade
Modified: 9/10/2026
MEDIUMPyPI
GHSA-mq44-7p77-q5h7· CVE-2026-59881, PYSEC-2026-3547AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
Modified: 9/10/2026
LOWPyPI
GHSA-mqqc-3gqh-h2x8· CVE-2025-69225, PYSEC-2026-1109AIOHTTP has unicode match groups in regexes for ASCII protocol elements
Modified: 9/10/2026
LOWPyPI
GHSA-mwh4-6h8g-pg8w· CVE-2026-34519, PYSEC-2026-2101AIOHTTP has HTTP response splitting via \r in reason phrase
Modified: 9/10/2026
MEDIUMPyPI
GHSA-p998-jp59-783m· CVE-2026-34515, PYSEC-2026-2097AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
Modified: 9/10/2026
MEDIUMPyPI
GHSA-pjjw-qhg8-p2p9aiohttp has vulnerable dependency that is vulnerable to request smuggling
Modified: 9/10/2026
HIGH7.2PyPI
GHSA-q3qx-c6g2-7pw2· CVE-2023-49081, PYSEC-2023-250aiohttp's ClientSession is vulnerable to CRLF injection via version
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-qvrw-v9rv-5rjx· CVE-2023-49082, PYSEC-2023-251aiohttp's ClientSession is vulnerable to CRLF injection via method
Modified: 9/10/2026
LOW3.1PyPI
GHSA-v6wp-4m6f-gcjg· CVE-2021-21330, PYSEC-2021-76`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)
Modified: 7/8/2026
MEDIUMPyPI
GHSA-w2fm-2cpv-w7v5· CVE-2026-22815, PYSEC-2026-2094aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage
Modified: 9/10/2026
MEDIUMPyPI
GHSA-xcgm-r5h9-7989· CVE-2026-54274, PYSEC-2026-2108aiohttp: Incomplete websocket frame payloads bypass memory limits
Modified: 9/10/2026
LOW3.4PyPI
GHSA-xx9p-xxvh-7g8j· CVE-2023-47641, PYSEC-2023-247Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks
Modified: 11/3/2025
—PyPI
PYSEC-2021-76· CVE-2021-21330, GHSA-v6wp-4m6f-gcjgModified: 11/8/2023
—PyPI
PYSEC-2023-120· CVE-2023-37276, GHSA-45c4-8wx5-qw6waiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser
Modified: 11/8/2023
HIGH7.5PyPI
PYSEC-2023-246· CVE-2023-47627, GHSA-gfw2-4jvh-wgfgModified: 11/22/2023
MEDIUM6.5PyPI
PYSEC-2023-247· CVE-2023-47641, GHSA-xx9p-xxvh-7g8jModified: 11/22/2023
MEDIUM5.3PyPI
PYSEC-2023-250· CVE-2023-49081, GHSA-q3qx-c6g2-7pw2Modified: 1/29/2024
MEDIUM5.3PyPI
PYSEC-2023-251· CVE-2023-49082, GHSA-qvrw-v9rv-5rjxModified: 1/29/2024
HIGH7.5PyPI
PYSEC-2024-24· CVE-2024-23334, GHSA-5h86-8mv2-jq9fModified: 2/5/2024
MEDIUM6.5PyPI
PYSEC-2024-26· CVE-2024-23829, GHSA-8qpw-xqxj-h4r2Modified: 2/6/2024
HIGH7.5PyPI
PYSEC-2026-1096· CVE-2024-52303, GHSA-27mf-ghqm-j3j8aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method
Modified: 7/7/2026
—PyPI
PYSEC-2026-1097· CVE-2025-69226, GHSA-54jq-c3m8-4m76AIOHTTP vulnerable to brute-force leak of internal static file path components
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1098· CVE-2024-30251, GHSA-5m98-qgg9-wh84aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
Modified: 7/7/2026
—PyPI
PYSEC-2026-1099· CVE-2025-69224, GHSA-69f9-5gxw-wvc2AIOHTTP's unicode processing of header values could cause parsing discrepancies
Modified: 7/7/2026
—PyPI
PYSEC-2026-1100· CVE-2025-69228, GHSA-6jhg-hg63-jvvfAIOHTTP vulnerable to denial of service through large payloads
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1101· CVE-2025-69223, GHSA-6mq8-rvhq-8wggAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Modified: 7/7/2026
MEDIUM6.1PyPI
PYSEC-2026-1102· CVE-2024-27306, GHSA-7gpw-8wmc-pm8gaiohttp Cross-site Scripting vulnerability on index pages for static file handling
Modified: 7/7/2026
—PyPI
PYSEC-2026-1103· CVE-2024-52304, GHSA-8495-4g3g-x7praiohttp allows request smuggling due to incorrect parsing of chunk extensions
Modified: 7/7/2026
—PyPI
PYSEC-2026-1104· CVE-2025-53643, GHSA-9548-qrrj-x5pjAIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections
Modified: 7/7/2026
—PyPI
PYSEC-2026-1105· CVE-2025-69230, GHSA-fh55-r93g-j68gAIOHTTP Vulnerable to Cookie Parser Warning Storm
Modified: 7/7/2026
—PyPI
PYSEC-2026-1106· CVE-2025-69229, GHSA-g84x-mcqj-x9qqAIOHTTP vulnerable to DoS through chunked messages
Modified: 7/7/2026
—PyPI
PYSEC-2026-1107· CVE-2025-69227, GHSA-jj3x-wxrx-4x23AIOHTTP vulnerable to DoS when bypassing asserts
Modified: 7/7/2026
MEDIUM4.8PyPI
PYSEC-2026-1108· CVE-2024-42367, GHSA-jwhx-xcg6-8xhjIn aiohttp, compressed files as symlinks are not protected from path traversal
Modified: 7/7/2026
—PyPI
PYSEC-2026-1109· CVE-2025-69225, GHSA-mqqc-3gqh-h2x8AIOHTTP has unicode match groups in regexes for ASCII protocol elements
Modified: 7/7/2026
—PyPI
PYSEC-2026-2094· CVE-2026-22815, GHSA-w2fm-2cpv-w7v5Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2095· CVE-2026-34513, GHSA-hcc4-c3v8-rx92Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2096· CVE-2026-34514, GHSA-2vrm-gr82-f7m5Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2097· CVE-2026-34515, GHSA-p998-jp59-783mModified: 7/13/2026
—PyPI
PYSEC-2026-2098· CVE-2026-34516, GHSA-m5qp-6w8w-w647Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2099· CVE-2026-34517, GHSA-3wq7-rqq7-wx6jModified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2100· CVE-2026-34518, GHSA-966j-vmvw-g2g9Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2101· CVE-2026-34519, GHSA-mwh4-6h8g-pg8wModified: 7/13/2026
—PyPI
PYSEC-2026-2102· CVE-2026-34520, GHSA-63hf-3vf5-4wqfModified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2103· CVE-2026-34525, GHSA-c427-h43c-vf67Modified: 7/13/2026
HIGH7.3PyPI
PYSEC-2026-2104· CVE-2026-34993, GHSA-jg22-mg44-37j8Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2105· CVE-2026-47265, GHSA-hg6j-4rv6-33pgModified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2106· CVE-2026-50269, GHSA-m6qw-4cw2-hm4mModified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2107· CVE-2026-54273, GHSA-4fvr-rgm6-gqmcModified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2108· CVE-2026-54274, GHSA-xcgm-r5h9-7989Modified: 7/13/2026
MEDIUM6.1PyPI
PYSEC-2026-2109· CVE-2026-54276, GHSA-hpj7-wq8m-9hgpModified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2110· CVE-2026-54277, GHSA-63hw-fmq6-xxg2Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2111· CVE-2026-54278, GHSA-g3cq-j2xw-wf74Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2112· CVE-2026-54279, GHSA-2fqr-mr3j-6wp8Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2113· CVE-2026-54280, GHSA-9x8q-7h8h-wcw9Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-237· CVE-2026-54275, GHSA-4m7w-qmgq-4wj5Modified: 6/27/2026
—PyPI
PYSEC-2026-3545· CVE-2026-69244, GHSA-cq5v-8q36-5273AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
Modified: 8/4/2026
—PyPI
PYSEC-2026-3546· CVE-2026-69243, GHSA-mfx4-hv73-q22vAIOHTTP: HTTP request smuggling via WebSocket upgrade
Modified: 8/4/2026
—PyPI
PYSEC-2026-3547· CVE-2026-59881, GHSA-mq44-7p77-q5h7AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
Modified: 8/4/2026