PT-2023-7245

🗓️ 29 Oct 2023 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 8 Views

Vulnerability in aiohttp prior to 3.9.0 allows HTTP request modification and smuggling risks.

Reporter	Title	Published	Views	Family All 269
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	17 Jun 202420:14	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	15 Feb 202413:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for AIOps	16 Oct 202422:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion is vulnerable to HTTP request smuggling, denial of server due to aiohttp, cryptography.	11 May 202416:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	15 Apr 202502:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl which is vulnerable to CVE-2024-23829, CVE-2023-49082, CVE-2024-23334 and CVE-2023-49081	15 Apr 202502:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in aio-libs aiohttp	26 Feb 202518:42	–	ibm
BDU FSTEC	The vulnerability of the aiohttp HTTP client, related to the failure to handle CRLF sequences for line termination, allows attackers to send hidden HTTP requests (HTTP Request Smuggling attack).	1 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the aiohttp HTTP client arises from insufficient validation of input data, allowing attackers to modify existing HTTP requests or create new ones.	6 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the aiohttp HTTP client, related to deficiencies in handling HTTP request headers, allows attackers to send hidden HTTP requests (HTTP Request Smuggling attack).	20 Mar 202400:00	–	bdu_fstec

Source	Link
github	www.github.com/aio-libs/aiohttp/commit/4075c653fb67a29740bf9ac050bb02d10a57343a
github	www.github.com/aio-libs/aiohttp/pull/7806/files
openeuler	www.openeuler.org/zh/security/security-bulletins/detail/
openeuler	www.openeuler.org/zh/security/security-bulletins/detail/
github	www.github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-251.yaml
github	www.github.com/aio-libs/aiohttp/commit/e4ae01c2077d2cfa116aa82e4ff6866857f7c466
osv	www.osv.dev/vulnerability/OESA-2025-1346
t	www.t.me/cvenotify/62236
gist	www.gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-27306

23 Jun 2026 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 46.9

CVSS 3.17.5

EPSS0.01094

SSVC

aiohttp vulnerability improper validation request smuggling update recommendation manual validation