aiohttp vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-111748Mediumaiohttp: AIOHTTP: Absolute-form request targets can spoof Request.schemeCVE-2026-111749Lowaiohttp: AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookiesCVE-2026-111065Mediumaiohttp: AIOHTTP: Connector pool exhaustion via Max-Age overflowCVE-2026-111750Mediumaiohttp: AIOHTTP: Pure-Python parser request smugglingCVE-2026-111066Highaiohttp: AIOHTTP: File descriptor exhaustion in multipart requestsCVE-2026-111064Highaiohttp: aiohttp server lacks an initial request/header timeoutCVE-2026-111063Mediumaiohttp: AIOHTTP: Secure attribute not enforced for shared cookieGHSA-2G87-PP6C-29X5Highaiohttp: aiohttp: Multiple instances of excessive or unbounded memory/CPU useCVE-2026-69244Highaiohttp: AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)CVE-2026-69243Mediumaiohttp: AIOHTTP: HTTP request smuggling via WebSocket upgradeCVE-2026-59881Mediumaiohttp: AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflateCVE-2026-54274Mediumaiohttp: aiohttp: Incomplete websocket frame payloads bypass memory limitsCVE-2026-54275Lowaiohttp: aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS ConnectionsCVE-2026-54280Lowaiohttp: aiohttp: Payload Response Resources Are Not Closed After Mid-Body DisconnectCVE-2026-54273Mediumaiohttp: aiohttp: HTTP/1 Pipelined Requests Queue Without LimitCVE-2026-54278Mediumaiohttp: aiohttp: Unread Compressed Request Bodies Bypass client_max_size During CleanupCVE-2026-54277Mediumaiohttp: aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented LinesCVE-2026-54276Mediumaiohttp: aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect ChallengesCVE-2026-54279Lowaiohttp: aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar PersistenceCVE-2026-50269Lowaiohttp: aiohttp: CRLF injection in multipart headersCVE-2026-47265Mediumaiohttp: AIOHTTP is vulnerable to cross-origin redirect with per-request cookiesCVE-2026-34993Mediumaiohttp: AIOHTTP is Vulnerable to Deserialization of Untrusted DataCVE-2026-34525Mediumaiohttp: AIOHTTP accepts duplicate Host headersCVE-2026-34520Lowaiohttp: AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypassCVE-2026-34519Lowaiohttp: AIOHTTP has HTTP response splitting via \r in reason phrase

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo