aiohttp-cors (0.3.0), aslack (0.11.0) +1 more potentially affected by CVE-2024-52304 via aiohttp (0.20.2)

aiohttp PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiohttp-cors 0.3.0 - aslack 0.11.0 - muffin =0.5.2, =0.5.12 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

muffin (>=0.1.1, <=0.1.4) potentially affected by CVE-2024-52304 via aiohttp (0.17.2)

aiohttp PYPI version 0.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.1, =0.1.4 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

muffin (>=0.3.0, <=0.3.2) potentially affected by CVE-2024-52304 via aiohttp (0.18.3)

aiohttp PYPI version 0.18.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.0, =0.3.2 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

muffin (>=0.2.0, <=0.2.1) potentially affected by CVE-2024-52304 via aiohttp (0.17.4)

aiohttp PYPI version 0.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.2.0, =0.2.1 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

geoffrey (>=0.1.0, <=0.1.2) potentially affected by CVE-2024-52304 via aiohttp (0.6.4)

aiohttp PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - geoffrey =0.1.0, =0.1.2 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

PYSEC-2026-1096 aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

Summary A memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. Impact If the user is making use of any middlewares with aiohttp.web then it is...

aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

SummaryA memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. ImpactIf the user is making use of any middlewares with aiohttp.web then it is advisab...

aiohttp allows request smuggling due to incorrect parsing of chunk extensions

SummaryThe Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. ImpactIf a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker may...

academic-metrics (>=0.1.0b0, <=1.0.99), act-workflow (>=4.8.2, <=4.8.399) +95 more potentially affected by CVE-2024-52303 via aiohttp (>=3.10.6, <=3.10.10)

aiohttp PYPI version =3.10.6, =0.1.0b0, =4.8.2, =1.0.1, =0.1.18, =1.2.0, =0.1.6, =0.1.3, =0.1.0, =0.1.3, =0.1.21, =0.0.4, =0.0.5 and more Source cves: CVE-2024-52303 Source advisory: OSV:PYSEC-2026-1096...

echod (0.1.0), muffin (>=0.0.94, <=0.0.97) potentially affected by CVE-2024-52304 via aiohttp (0.16.5)

aiohttp PYPI version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - echod 0.1.0 - muffin =0.0.94, =0.0.97 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2024-52304 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

muffin (>=0.0.105, <=0.0.106) potentially affected by CVE-2024-52304 via aiohttp (0.17.0)

aiohttp PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.105, =0.0.106 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2024-52304 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

interest (0.0.1) potentially affected by CVE-2024-52304 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

iamine (>=0.1.5, <=0.1.6) potentially affected by CVE-2024-52304 via aiohttp (0.13.1)

aiohttp PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - iamine =0.1.5, =0.1.6 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

muffin (>=0.0.23, <=0.0.45) potentially affected by CVE-2024-52304 via aiohttp (0.14.4)

aiohttp PYPI version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.23, =0.0.45 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

muffin (>=0.7.1, <=0.8.6) potentially affected by CVE-2024-52304 via aiohttp (0.21.6)

aiohttp PYPI version 0.21.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.7.1, =0.8.6 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

pushpull (0.0.2) potentially affected by CVE-2024-52304 via aiohttp (0.22.0)

aiohttp PYPI version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pushpull 0.0.2 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2024-52304 via aiohttp (1.1.5)

aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2024-52304 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...