CVE-2023-37276

🗓️ 19 Jul 2023 20:10:15Reported by GitHub_MType

aiohttp v3.8.4 and earlier bundled with llhttp v6.0.6, HTTP request smuggling vulnerabilit

Reporter	Title	Published	Views	Family All 25
Cvelist	CVE-2023-37276 aiohttp vulnerable to HTTP request smuggling	19 Jul 202319:39	–	cvelist
Prion	Design/Logic Flaw	19 Jul 202320:15	–	prion
RedhatCVE	CVE-2023-37276	21 Jul 202311:30	–	redhatcve
NVD	CVE-2023-37276	19 Jul 202320:15	–	nvd
UbuntuCve	CVE-2023-37276	19 Jul 202300:00	–	ubuntucve
Veracode	HTTP Request Smuggling	21 Jul 202308:44	–	veracode
OSV	CVE-2023-37276	19 Jul 202320:15	–	osv
OSV	aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser	20 Jul 202314:52	–	osv
OSV	aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser	20 Jul 202314:52	–	osv
OSV	Red Hat Security Advisory: RHUI 4.8 Release - Security Updates, Bug Fixes, and Enhancements	28 Sep 202404:02	–	osv

Nvd

Vulners

Vulnrichment

Node

aiohttp aiohttpRange≤3.8.4

[
  {
    "vendor": "aio-libs",
    "product": "aiohttp",
    "versions": [
      {
        "version": "< 3.8.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
hackerone	www.hackerone.com/reports/2001873
github	www.github.com/aio-libs/aiohttp/commit/9337fb3f2ab2b5f38d7e98a194bde6f7e3d16c40
github	www.github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w
github	www.github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodules

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

19 Jul 2023 20:15Current

6.2Medium risk

Vulners AI Score6.2

CVSS35.3 - 7.5

EPSS0.002

SSVC

CWE-444