python aiohttp vulnerabilities

Latest python aiohttp CVEs

Newest publication first

1. CVE-2024-52304 aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

   Published 2024-11-18

   Medium·CVSS 6.3 EPSS 0.56%

   aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of ai...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.