Aiohttp - vulnerabilities (CVEs)

44 CVEs in 2 products, 0 in the last 30 days, newest from 2026-06-22.

Products

• Aiohttp - 44 CVEs
• Aio-libs - 1 CVEs

Newest CVEs of Aiohttp

• CVE-2026-54273 - CVSS 7.5 (high), 2026-06-22: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that…
• CVE-2026-54280 - CVSS 7.5 (high), 2026-06-22: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client…
• CVE-2026-54278 - CVSS 7.5 (high), 2026-06-22: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body…
• CVE-2026-54277 - CVSS 7.5 (high), 2026-06-22: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of…
• CVE-2026-54276 - CVSS 6.3 (medium), 2026-06-22: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response…
• CVE-2026-54275 - CVSS 7.5 (high), 2026-06-22: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an…
• CVE-2026-54274 - CVSS 7.5 (high), 2026-06-22: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame…
• CVE-2026-54279 - CVSS 7.5 (high), 2026-06-22: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and…
• CVE-2026-50269 - CVSS 7.5 (high), 2026-06-22: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload…
• CVE-2026-47265 - CVSS 7.5 (high), 2026-06-02: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests…
• CVE-2026-34993 - CVSS 7.3 (high), 2026-06-02: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may…
• CVE-2026-34520 - CVSS 9.1 (critical), 2026-04-01: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted…
• CVE-2026-34519 - CVSS 5.3 (medium), 2026-04-01: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when…
• CVE-2026-34518 - CVSS 5.3 (medium), 2026-04-01: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin,…
• CVE-2026-34525 - CVSS 6.3 (medium), 2026-04-01: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This…
• CVE-2026-34517 - CVSS 5.3 (medium), 2026-04-01: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the…
• CVE-2026-34513 - CVSS 7.5 (high), 2026-04-01: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive…
• CVE-2026-34516 - CVSS 7.5 (high), 2026-04-01: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart…
• CVE-2026-34515 - CVSS 7.5 (high), 2026-04-01: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose…
• CVE-2026-34514 - CVSS 5.3 (medium), 2026-04-01: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter…
• CVE-2026-22815 - CVSS 7.5 (high), 2026-04-01: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling…
• CVE-2025-69229 - CVSS 6.6 (medium), 2026-01-06: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in…
• CVE-2025-69228 - CVSS 7.5 (high), 2026-01-06: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an…
• CVE-2025-69227 - CVSS 7.5 (high), 2026-01-06: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert…
• CVE-2025-69230 - CVSS 5.3 (medium), 2026-01-06: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a…
• CVE-2025-69225 - CVSS 5.3 (medium), 2026-01-06: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals…
• CVE-2025-69226 - CVSS 6.3 (medium), 2026-01-05: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of…
• CVE-2025-69224 - CVSS 6.5 (medium), 2026-01-05: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request…
• CVE-2025-69223 - CVSS 7.5 (high), 2026-01-05: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against…
• CVE-2025-53643 - CVSS 7.5 (high), 2025-07-14: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request…