aio-libs aiohttp

• CVE-2026-111750 Medium 6.3 AIOHTTP: Pure-Python parser request smuggling 0.4%
• CVE-2026-111749 Low 2.3 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies 0.4%
• CVE-2026-111748 Medium 6.3 AIOHTTP: Absolute-form request targets can spoof Request.scheme 0.4%
• CVE-2026-111066 High 8.2 AIOHTTP: File descriptor exhaustion in multipart requests 0.4%
• CVE-2026-111065 Medium 6.9 AIOHTTP: Connector pool exhaustion via Max-Age overflow 0.4%
• CVE-2026-111064 High 8.2 aiohttp server lacks an initial request/header timeout 0.4%
• CVE-2026-111063 Medium 6.3 AIOHTTP: Secure attribute not enforced for shared cookie 0.2%
• CVE-2026-69244 High 7.1 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) 0.5%
• CVE-2026-69243 Medium 6.3 AIOHTTP: HTTP request smuggling via WebSocket upgrade 0.4%
• CVE-2026-59881 Medium 6.9 AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate 0.5%
• CVE-2026-54273 Medium 6.6 AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit 0.5%
• CVE-2026-54280 Low 1.7 AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect 0.5%
• CVE-2026-54278 Medium 6.6 AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup 0.5%
• CVE-2026-54277 Medium 6.6 AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines 0.6%
• CVE-2026-54276 Medium 6.3 AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges 0.3%
• CVE-2026-54275 Low 2.7 AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections 0.5%
• CVE-2026-54274 Medium 6.6 AIOHTTP: Incomplete websocket frame payloads bypass memory limits 0.5%
• CVE-2026-54279 Low 1.3 AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence 0.5%
• CVE-2026-50269 Low 2.7 AIOHTTP: CRLF injection in multipart headers 0.5%
• CVE-2026-47265 Medium 6.6 AIOHTTP vulnerable to cross-origin redirect with per-request cookies 0.1%
• CVE-2026-34993 Medium 6.4 AIOHTTP Vulnerable to Deserialization of Untrusted Data 0.2%
• CVE-2026-34525 Medium 6.3 AIOHTTP: Duplicate Host header accepted 0.3%
• CVE-2026-34520 Critical 9.1 AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass 0.5%
• CVE-2026-34519 Low 2.7 AIOHTTP: HTTP response splitting via \r in reason phrase 0.3%
• CVE-2026-34518 Low 2.7 AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect 0.4%
• CVE-2026-34517 Low 2.7 AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS 0.4%
• CVE-2026-34516 High 7.5 AIOHTTP: Multipart Header Size Bypass 0.5%
• CVE-2026-34515 Medium 6.6 AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows 0.4%
• CVE-2026-34514 Low 2.7 AIOHTTP: CRLF injection in multipart part content type header construction 0.3%
• CVE-2026-22815 High 7.5 AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers 0.5%
• CVE-2026-34513 Low 2.7 AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector 0.5%
• CVE-2025-69230 Low 2.7 AIOHTTP Vulnerable to Cookie Parser Warning Storm 0.4%
• CVE-2025-69229 Medium 6.6 AIOHTTP vulnerable to DoS through chunked messages 0.4%
• CVE-2025-69228 Medium 6.6 AIOHTTP vulnerable to denial of service through large payloads 0.4%
• CVE-2025-69227 Medium 6.6 AIOHTTP vulnerable to DoS when bypassing asserts 0.4%
• CVE-2025-69225 Low 2.7 AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields 0.3%
• CVE-2025-69226 Medium 6.3 AIOHTTP allows for a brute-force leak of internal static filepath components 0.4%
• CVE-2025-69224 Medium 6.3 AIOHTTP's Unicode processing of header values could cause parsing discrepancies 0.2%
• CVE-2025-69223 High 7.5 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb 0.6%
• CVE-2025-53643 Low 1.7 AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections 0.4%
• CVE-2024-52304 Medium 6.3 aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions 0.6%
• CVE-2024-52303 High 7.5 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method 0.6%
• CVE-2024-42367 Medium 4.8 In aiohttp, compressed files as symlinks are not protected from path traversal 0.7%
• CVE-2024-30251 High 7.5 Denial of service when trying to parse malformed POST requests in aiohttp 1.1%
• CVE-2024-27306 Medium 6.1 aiohttp vulnerable to XSS on index pages for static file handling 0.7%
• CVE-2024-23334 Medium 5.9 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal 76.9%
• CVE-2024-23829 Medium 6.5 aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators 1.0%
• CVE-2023-49081 High 7.2 aiohttp's ClientSession is vulnerable to CRLF injection via version 0.9%
• CVE-2023-49082 Medium 5.3 aiohttp's ClientSession is vulnerable to CRLF injection via method 0.9%
• CVE-2023-47627 Medium 5.3 Request smuggling in aiohttp 0.9%