Latest vulnerabilities for "aiohttp aiohttp"

pip/aiohttpAIOHTTP: Incomplete websocket frame payloads bypass memory limits

Risk 43

Severity

6.6

First published (updated )

CVE-2026-54274

pip/aiohttpAIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Risk 43

Severity

2.7

First published (updated )

CVE-2026-54275

pip/aiohttpAIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

Risk 43

Severity

1.7

First published (updated )

CVE-2026-54280

pip/aiohttpAIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

Risk 43

Severity

6.6

First published (updated )

CVE-2026-54273

pip/aiohttpAIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

Risk 43

Severity

6.6

First published (updated )

CVE-2026-54278

pip/aiohttpAIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

Risk 43

Severity

6.6

First published (updated )

CVE-2026-54277

pip/aiohttpAIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

Risk 29

Severity

6.3

First published (updated )

CVE-2026-54276

pip/aiohttpAIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Risk 43

Severity

1.3

First published (updated )

CVE-2026-54279

pip/aiohttpAIOHTTP: CRLF injection in multipart headers

Risk 43

Severity

2.7

First published (updated )

CVE-2026-50269

aiohttp aiohttpAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1…

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2484099

pypi/aiohttpAIOHTTP vulnerable to cross-origin redirect with per-request cookies

Risk 43

Severity

6.6

First published (updated )

CVE-2026-47265

pypi/aiohttpAIOHTTP Vulnerable to Deserialization of Untrusted Data

Risk 64

Severity

7.3

First published (updated )

CVE-2026-34993

pip/aiohttpAIOHTTP: Duplicate Host header accepted

Risk 37

Severity

6.3

First published (updated )

CVE-2026-34525

pip/aiohttpAIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass

Risk 66

Severity

2.7

First published (updated )

CVE-2026-34520

pip/aiohttpAIOHTTP: HTTP response splitting via \r in reason phrase

Risk 27

Severity

2.7

First published (updated )

CVE-2026-34519

pip/aiohttpAIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

Risk 27

Severity

2.7

First published (updated )

CVE-2026-34518

pip/aiohttpAIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS

Risk 27

Severity

2.7

First published (updated )

CVE-2026-34517

pip/aiohttpAIOHTTP: Multipart Header Size Bypass

Risk 43

Severity

6.6

First published (updated )

CVE-2026-34516

pip/aiohttpAIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

Risk 43

Severity

6.6

First published (updated )

CVE-2026-34515

pip/aiohttpAIOHTTP: CRLF injection in multipart part content type header construction

Risk 27

Severity

2.7

First published (updated )

CVE-2026-34514

pip/aiohttpAIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

Risk 43

Severity

2.7

First published (updated )

CVE-2026-34513

pip/aiohttpAIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

Risk 43

Severity

6.9

First published (updated )

CVE-2026-22815

pip/aiohttpAIOHTTP Vulnerable to Cookie Parser Warning Storm

Risk 29

Severity

2.7

First published (updated )

CVE-2025-69230

pip/aiohttpAIOHTTP vulnerable to DoS through chunked messages

Risk 43

Severity

6.6

First published (updated )

CVE-2025-69229

pip/aiohttpAIOHTTP vulnerable to denial of service through large payloads

Risk 46

Severity

6.6

First published (updated )

CVE-2025-69228

pypi/aiohttpAIOHTTP vulnerable to DoS when bypassing asserts

Risk 46

Severity

6.6

First published (updated )

CVE-2025-69227

pypi/aiohttpAIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields

Risk 29

Severity

2.7

First published (updated )

CVE-2025-69225

pypi/aiohttpAIOHTTP allows for a brute-force leak of internal static ﬁlepath components

Risk 31

Severity

6.3

First published (updated )

CVE-2025-69226

pypi/aiohttpAIOHTTP's Unicode processing of header values could cause parsing discrepancies

Risk 42

Severity

6.5

First published (updated )

CVE-2025-69224

pypi/aiohttpAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Risk 46

Severity

7.5

First published (updated )

CVE-2025-69223

Trending

Versions

pip/aiohttpAIOHTTP: Incomplete websocket frame payloads bypass memory limits

pip/aiohttpAIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

pip/aiohttpAIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

pip/aiohttpAIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

pip/aiohttpAIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

Don't miss critical vulnerabilities

pip/aiohttpAIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

pip/aiohttpAIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

pip/aiohttpAIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

pip/aiohttpAIOHTTP: CRLF injection in multipart headers

aiohttp aiohttpAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1…

Don't miss critical vulnerabilities

pypi/aiohttpAIOHTTP vulnerable to cross-origin redirect with per-request cookies

pypi/aiohttpAIOHTTP Vulnerable to Deserialization of Untrusted Data

pip/aiohttpAIOHTTP: Duplicate Host header accepted

pip/aiohttpAIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass

pip/aiohttpAIOHTTP: HTTP response splitting via \r in reason phrase

Don't miss critical vulnerabilities

pip/aiohttpAIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

pip/aiohttpAIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS

pip/aiohttpAIOHTTP: Multipart Header Size Bypass

pip/aiohttpAIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

pip/aiohttpAIOHTTP: CRLF injection in multipart part content type header construction

Don't miss critical vulnerabilities

pip/aiohttpAIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

pip/aiohttpAIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

pip/aiohttpAIOHTTP Vulnerable to Cookie Parser Warning Storm

pip/aiohttpAIOHTTP vulnerable to DoS through chunked messages

pip/aiohttpAIOHTTP vulnerable to denial of service through large payloads

Don't miss critical vulnerabilities

pypi/aiohttpAIOHTTP vulnerable to DoS when bypassing asserts

pypi/aiohttpAIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields

pypi/aiohttpAIOHTTP allows for a brute-force leak of internal static ﬁlepath components

pypi/aiohttpAIOHTTP's Unicode processing of header values could cause parsing discrepancies

pypi/aiohttpAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Don't miss critical vulnerabilities

Company

Resources

Contact