aiohttp vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-54274Mediumaiohttp: aiohttp: Incomplete websocket frame payloads bypass memory limits CVE-2026-54275Lowaiohttp: aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections CVE-2026-54280Lowaiohttp: aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect CVE-2026-54273Mediumaiohttp: aiohttp: HTTP/1 Pipelined Requests Queue Without Limit CVE-2026-54278Mediumaiohttp: aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup CVE-2026-54277Mediumaiohttp: aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines CVE-2026-54276Mediumaiohttp: aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges CVE-2026-54279Lowaiohttp: aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence CVE-2026-50269Lowaiohttp: aiohttp: CRLF injection in multipart headers CVE-2026-47265Mediumaiohttp: AIOHTTP is vulnerable to cross-origin redirect with per-request cookies CVE-2026-34993Mediumaiohttp: AIOHTTP is Vulnerable to Deserialization of Untrusted Data CVE-2026-34525Mediumaiohttp: AIOHTTP accepts duplicate Host headers CVE-2026-34520Lowaiohttp: AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values -…CVE-2026-34519Lowaiohttp: AIOHTTP has HTTP response splitting via \r in reason phrase CVE-2026-34518Lowaiohttp: AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect CVE-2026-34517Lowaiohttp: AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS CVE-2026-34516Mediumaiohttp: AIOHTTP has a Multipart Header Size Bypass CVE-2026-34515Mediumaiohttp: AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on…CVE-2026-34514Lowaiohttp: AIOHTTP has CRLF injection through multipart part content type header construction CVE-2026-34513Lowaiohttp: AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector CVE-2026-22815Mediumaiohttp: aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage CVE-2025-69230Lowaiohttp: AIOHTTP Vulnerable to Cookie Parser Warning Storm CVE-2025-69229Mediumaiohttp: AIOHTTP vulnerable to DoS through chunked messages CVE-2025-69228Mediumaiohttp: AIOHTTP vulnerable to denial of service through large payloads CVE-2025-69227Mediumaiohttp: AIOHTTP vulnerable to DoS when bypassing asserts

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo