CVE-2026-50269

AIOHTTP: CRLF injection in multipart headers

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-54279

AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-54274

AIOHTTP: Incomplete websocket frame payloads bypass memory limits

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-54275

AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-54280

AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-54273

AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-47265

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-34518

AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-34519

AIOHTTP: HTTP response splitting via \r in reason phrase

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-34520

AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-34514

AIOHTTP: CRLF injection in multipart part content type header construction

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-34515

AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2026-34516

AIOHTTP: Multipart Header Size Bypass

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2025-62611

aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server

aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Aio-libs

Products

Aiomysql

CVE-2024-34083

STARTTLS unencrypted commands injection

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs

Products

Aiosmtpd

CVE-2026-22815

AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2025-69229

AIOHTTP vulnerable to DoS through chunked messages

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aio-libs Project Aiohttp

Products

Aiohttp Session Aiohttp Aio-libs and 1 more

CVE-2025-69230

AIOHTTP Vulnerable to Cookie Parser Warning Storm

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header. This issue is fixed in 3.13.3.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aio-libs Project Aiohttp

Products

Aiohttp Session Aiohttp Aio-libs and 1 more

CVE-2025-69228

AIOHTTP vulnerable to denial of service through large payloads

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory. This issue is fixed in version 3.13.3.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aio-libs Project Aiohttp

Products

Aiohttp Session Aiohttp Aio-libs and 1 more

CVE-2025-69227

AIOHTTP vulnerable to DoS when bypassing asserts

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aio-libs Project Aiohttp

Products

Aiohttp Session Aiohttp Aio-libs and 1 more