Product by Aio-libs
Aiohttp
53 known vulnerabilities in Aiohttp (Aio-libs), 0 of them actively exploited (CISA KEV).
Key figures
53
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-23334 | aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal | 5.9 | |
| High | CVE-2026-111066 | AIOHTTP: File descriptor exhaustion in multipart requests | — | |
| High | CVE-2026-111064 | aiohttp server lacks an initial request/header timeout | — | |
| High | CVE-2024-30251 | Denial of service when trying to parse malformed POST requests in aiohttp | 7.5 | |
| Critical | CVE-2026-34520 | Aio-libs Aiohttp: HTTP Request/Response Splitting | 9.1 | |
| High | CVE-2026-54277 | AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines | 7.5 | |
| Medium | CVE-2026-111065 | AIOHTTP: Connector pool exhaustion via Max-Age overflow | — | |
| High | CVE-2026-69244 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) | — | |
| High | CVE-2026-54274 | AIOHTTP: Incomplete websocket frame payloads bypass memory limits | 7.5 | |
| High | CVE-2026-50269 | AIOHTTP: CRLF injection in multipart headers | 7.5 | |
| Medium | CVE-2026-59881 | AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate | — | |
| High | CVE-2026-54279 | AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence | 7.5 | |
| High | CVE-2026-54278 | AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup | 7.5 | |
| High | CVE-2026-54273 | AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit | 7.5 | |
| High | CVE-2023-37276 | aiohttp vulnerable to HTTP request smuggling | 5.3 | |
| Medium | CVE-2026-111748 | AIOHTTP: Absolute-form request targets can spoof Request.scheme | — | |
| High | CVE-2026-54275 | AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections | 7.5 | |
| Medium | CVE-2026-111750 | AIOHTTP: Pure-Python parser request smuggling | — | |
| High | CVE-2026-54280 | AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect | 7.5 | |
| Medium | CVE-2024-23829 | aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators | 6.5 | |
| High | CVE-2024-52303 | aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method | 7.5 | |
| High | CVE-2025-69223 | AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb | 7.5 | |
| High | CVE-2023-49081 | aiohttp's ClientSession is vulnerable to CRLF injection via version | 7.2 | |
| Medium | CVE-2021-21330 | Open redirect vulnerability in aiohttp | 3.1 | |
| High | CVE-2026-34516 | AIOHTTP: Multipart Header Size Bypass | 7.5 |