The vulnerability of the HTTP message analyzer for the llhttp HTTP client and aiohttp allows attackers to inject arbitrary HTTP headers and circumvent existing security restrictions.

The vulnerability of the HTTP message analyzer for the llhttp HTTP client and aiohttp is related to the failure to handle CRLF sequences in HTTP headers when processing the reason parameter. Exploiting this vulnerability allows an attacker to inject arbitrary HTTP headers and circumvent existing...

The vulnerability of the aiohttp HTTP client, related to the failure to handle CRLF sequences in HTTP headers, allows attackers to inject arbitrary HTTP headers.

The vulnerability of the aiohttp HTTP client is related to the failure to handle CRLF sequences in HTTP headers when processing the contenttype parameter. Exploiting this vulnerability allows an attacker to inject arbitrary HTTP headers remotely...

The vulnerability of the aiohttp HTTP client, related to unlimited resource distribution or throttling, allows attackers to cause service failures.

The vulnerability of the aiohttp HTTP client is related to unlimited resource allocation or throttling. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of the Request.post() function in the aiohttp HTTP client allows a attacker to trigger a service failure.

The vulnerability of the Request.post function in the aiohttp HTTP client is related to unlimited resource distribution or throttling. Exploiting this vulnerability could allow a remote attacker to cause service failures...

The vulnerability of the aiohttp HTTP client, related to insufficient protection of service data, allows attackers to disclose the protected information.

The vulnerability of the aiohttp HTTP client is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the protected information...

The vulnerability of the aiohttp HTTP client, related to the failure to handle CRLF sequences in HTTP headers, allows attackers to inject arbitrary HTTP headers.

The vulnerability of the aiohttp HTTP client is related to the failure to handle CRLF sequences in HTTP headers when processing the reason parameter. Exploiting this vulnerability allows an attacker who operates remotely to inject arbitrary HTTP headers...

The vulnerability of the aiohttp HTTP client, related to incorrect pathname restrictions for directories, allows attackers to disclose protected information.

The vulnerability of the aiohttp HTTP client is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a remote attacker to disclose sensitive information that is protected by the system...

The vulnerability of the Application.add_domain() function in the aiohttp HTTP client allows a perpetrator to cause a service failure.

The vulnerability of the Application.adddomain function in the HTTP client of aiohttp is related to the use of duplicate headers due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause service failures...

PT-2026-59655

Impact There are two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases...

The vulnerability of the TCPConnector HTTP-client library aiohttp, which allows a hacker to trigger a service failure.

The vulnerability of the TCPConnector HTTP-client library from aiohttp is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

The vulnerability of the aiohttp HTTP client, related to uncontrolled resource consumption, allows attackers to trigger a service failure.

The vulnerability of the aiohttp HTTP client is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

AIOHTTP Vulnerable to Cookie Parser Warning Storm

SummaryReading multiple invalid cookies can lead to a logging storm. ImpactIf the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.----Patch:...

AIOHTTP vulnerable to denial of service through large payloads

SummaryA request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing. ImpactIf an application includes a handler that uses the Request.post method, an attacker may be able to freeze the server by exhausting the memory.-----Patch:...

AIOHTTP vulnerable to DoS through chunked messages

SummaryHandling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. ImpactIf an application makes use of the request.read method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU ti...

PYSEC-2026-1106 AIOHTTP vulnerable to DoS through chunked messages

Summary Handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. Impact If an application makes use of the request.read method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU...

PYSEC-2026-1100 AIOHTTP vulnerable to denial of service through large payloads

Summary A request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing. Impact If an application includes a handler that uses the Request.post method, an attacker may be able to freeze the server by exhausting the memory. ----- Patch:...

PYSEC-2026-1105 AIOHTTP Vulnerable to Cookie Parser Warning Storm

Summary Reading multiple invalid cookies can lead to a logging storm. Impact If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header. ---- Patch:...

AIOHTTP vulnerable to brute-force leak of internal static file path components

SummaryPath normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain theexistence of absolute path components. ImpactIf an application uses web.static not recommended for production deployments, it may be possible for an attacker to ascertain t...

PYSEC-2026-1097 AIOHTTP vulnerable to brute-force leak of internal static file path components

Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components. Impact If an application uses web.static not recommended for production deployments, it may be possible for an attacker to ascertai...

AIOHTTP vulnerable to DoS when bypassing asserts

SummaryWhen assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body. ImpactIf optimisations are enabled -O or PYTHONOPTIMIZE=1, and the application includes a handler that uses the Request.post method, then an attacker may be able to execu...