Product by Debian
Python-aiohttp
36 known vulnerabilities in Python-aiohttp (Debian), 0 of them actively exploited (CISA KEV).
Key figures
36
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-23334 | aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal | 5.9 | |
| High | CVE-2024-30251 | Denial of service when trying to parse malformed POST requests in aiohttp | 7.5 | |
| Critical | CVE-2026-34520 | Aio-libs Aiohttp: HTTP Request/Response Splitting | 9.1 | |
| High | CVE-2026-54277 | AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines | 7.5 | |
| High | CVE-2026-54274 | AIOHTTP: Incomplete websocket frame payloads bypass memory limits | 7.5 | |
| High | CVE-2026-50269 | AIOHTTP: CRLF injection in multipart headers | 7.5 | |
| Medium | CVE-2026-59881 | AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate | — | |
| High | CVE-2026-54279 | AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence | 7.5 | |
| High | CVE-2026-54280 | AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect | 7.5 | |
| Medium | CVE-2024-23829 | aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators | 6.5 | |
| High | CVE-2025-69223 | AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb | 7.5 | |
| High | CVE-2023-49081 | aiohttp's ClientSession is vulnerable to CRLF injection via version | 7.2 | |
| Medium | CVE-2021-21330 | Open redirect vulnerability in aiohttp | 3.1 | |
| High | CVE-2026-34516 | AIOHTTP: Multipart Header Size Bypass | 7.5 | |
| High | CVE-2026-34513 | AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector | 7.5 | |
| High | CVE-2026-22815 | AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers | 7.5 | |
| Medium | CVE-2026-69243 | AIOHTTP: HTTP request smuggling via WebSocket upgrade | — | |
| High | CVE-2024-52304 | aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions | 7.5 | |
| High | CVE-2025-69228 | AIOHTTP vulnerable to denial of service through large payloads | 7.5 | |
| Medium | CVE-2023-49082 | aiohttp's ClientSession is vulnerable to CRLF injection via method | 5.3 | |
| High | CVE-2025-69227 | AIOHTTP vulnerable to DoS when bypassing asserts | 7.5 | |
| High | CVE-2023-47627 | Request smuggling in aiohttp | 5.3 | |
| Medium | CVE-2024-27306 | aiohttp vulnerable to XSS on index pages for static file handling | 6.1 | |
| High | CVE-2026-47265 | AIOHTTP vulnerable to cross-origin redirect with per-request cookies | 7.5 | |
| Medium | CVE-2025-69229 | AIOHTTP vulnerable to DoS through chunked messages | 5.3 |