Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 42

Export CSV
CVE-2026-54279

AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2026-54274

AIOHTTP: Incomplete websocket frame payloads bypass memory limits

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2026-54275

AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2026-54280

AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2026-54273

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2026-47265

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2026-34518

AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2026-34519

AIOHTTP: HTTP response splitting via \r in reason phrase

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2026-34520

AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2026-34514

AIOHTTP: CRLF injection in multipart part content type header construction

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2026-34515

AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2026-34516

AIOHTTP: Multipart Header Size Bypass

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2026-22815

AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2025-69229

AIOHTTP vulnerable to DoS through chunked messages

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aio-libs Project Aiohttp
Products
Aiohttp Session Aiohttp Aio-libs and 1 more
CVE-2025-69230

AIOHTTP Vulnerable to Cookie Parser Warning Storm

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header. This issue is fixed in 3.13.3.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aio-libs Project Aiohttp
Products
Aiohttp Session Aiohttp Aio-libs and 1 more
CVE-2025-69228

AIOHTTP vulnerable to denial of service through large payloads

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory. This issue is fixed in version 3.13.3.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aio-libs Project Aiohttp
Products
Aiohttp Session Aiohttp Aio-libs and 1 more
CVE-2025-69227

AIOHTTP vulnerable to DoS when bypassing asserts

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aio-libs Project Aiohttp
Products
Aiohttp Session Aiohttp Aio-libs and 1 more
CVE-2025-69226

AIOHTTP allows for a brute-force leak of internal static filepath components

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aio-libs Project Aiohttp
Products
Aiohttp Session Aiohttp Aio-libs and 1 more
CVE-2025-69225

AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aio-libs Project Aiohttp
Products
Aiohttp Session Aiohttp Aio-libs and 1 more
CVE-2025-69224

AIOHTTP's Unicode processing of header values could cause parsing discrepancies

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aio-libs Project Aiohttp
Products
Aiohttp Session Aiohttp Aio-libs and 1 more