Aio-libs Aiohttp
43 CVEs affecting Aio-libs Aiohttp. Latest disclosed: 2026-06-22. Critical: 1, High: 21.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34520 | Critical | 9.1 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted… |
CVE-2026-54280 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disco… |
CVE-2026-54279 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and the… |
CVE-2026-54278 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to… |
CVE-2026-54277 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of a… |
CVE-2026-54275 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an exis… |
CVE-2026-54274 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads… |
CVE-2026-54273 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that… |
CVE-2026-50269 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload head… |
CVE-2026-47265 | High | 7.5 | 2026-06-02 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests a… |
CVE-2026-34516 | High | 7.5 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart heade… |
CVE-2026-34515 | High | 7.5 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose info… |
CVE-2026-34513 | High | 7.5 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memor… |
CVE-2026-22815 | High | 7.5 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling c… |
CVE-2025-69228 | High | 7.5 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an A… |
CVE-2025-69227 | High | 7.5 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert state… |
CVE-2025-69223 | High | 7.5 | 2026-01-05 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against… |
CVE-2025-53643 | High | 7.5 | 2025-07-14 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smugglin… |
CVE-2024-52304 | High | 7.5 | 2024-11-18 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions… |
CVE-2024-52303 | High | 7.5 | 2024-11-18 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur… |