aiohttp vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-34518Lowaiohttp: AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect CVE-2026-34517Lowaiohttp: AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS CVE-2026-34516Mediumaiohttp: AIOHTTP has a Multipart Header Size Bypass CVE-2026-34515Mediumaiohttp: AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows CVE-2026-34514Lowaiohttp: AIOHTTP has CRLF injection through multipart part content type header construction CVE-2026-34513Lowaiohttp: AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector CVE-2026-22815Mediumaiohttp: aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage CVE-2025-69230Lowaiohttp: AIOHTTP Vulnerable to Cookie Parser Warning Storm CVE-2025-69229Mediumaiohttp: AIOHTTP vulnerable to DoS through chunked messages CVE-2025-69228Mediumaiohttp: AIOHTTP vulnerable to denial of service through large payloads CVE-2025-69227Mediumaiohttp: AIOHTTP vulnerable to DoS when bypassing asserts CVE-2025-69226Lowaiohttp: AIOHTTP vulnerable to brute-force leak of internal static ﬁle path components CVE-2025-69225Lowaiohttp: AIOHTTP has unicode match groups in regexes for ASCII protocol elements CVE-2025-69224Lowaiohttp: AIOHTTP's unicode processing of header values could cause parsing discrepancies CVE-2025-69223Highaiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb CVE-2025-53643Lowaiohttp: AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections CVE-2024-52304Mediumaiohttp: aiohttp allows request smuggling due to incorrect parsing of chunk extensions CVE-2024-52303Mediumaiohttp: aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method CVE-2024-42367Mediumaiohttp: In aiohttp, compressed files as symlinks are not protected from path traversal CVE-2024-30251Highaiohttp: aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests CVE-2024-27306Mediumaiohttp: aiohttp Cross-site Scripting vulnerability on index pages for static file handling CVE-2024-23334Highaiohttp: aiohttp is vulnerable to directory traversal CVE-2024-23829Mediumaiohttp: aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators CVE-2023-49081Mediumaiohttp: aiohttp's ClientSession is vulnerable to CRLF injection via version CVE-2023-49082Mediumaiohttp: aiohttp's ClientSession is vulnerable to CRLF injection via method

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.