aiogremlin (>=3.2.4b1, <=3.2.5), goblin (2.0.0b1) +3 more potentially affected by CVE-2025-53643 via aiohttp (1.3.3)

aiohttp PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin =3.2.4b1, =0.39.0, =1.0.0b1, =1.0.0b2 - okami 0.1.4 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2025-53643 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2025-53643 via aiohttp (1.1.6)

aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

homeassistant (>=0.36.0, <=0.37.1), hypr (0.8.2) +3 more potentially affected by CVE-2025-53643 via aiohttp (1.2.0)

aiohttp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.36.0, =0.1.0, =0.1.0, =1.5.9, =1.5.12 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2025-53643 via aiohttp (1.1.5)

aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...

devtools-proxy (>=0.0.2, <=0.0.3) potentially affected by CVE-2025-53643 via aiohttp (1.1.4)

aiohttp PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - devtools-proxy =0.0.2, =0.0.3 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2025-53643 via aiohttp (0.14.1)

aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

geoffrey (>=0.1.0, <=0.1.2) potentially affected by CVE-2025-53643 via aiohttp (0.6.4)

aiohttp PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - geoffrey =0.1.0, =0.1.2 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

Summary The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. Impact If a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execu...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via incorrect parsing of the trailer section in HTTP requests. An attacker can bypass firewall or proxy protections by crafting specially formed HTTP requests. Note: This is exploitable if the pure Python version ...

0x20bf (0.0.1), 2keys (0.5.1) +2948 more potentially affected by CVE-2025-53643 via aiohttp (>=3.0.0b0, <=3.12.13)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.0, =0.1.0b0, =1.0.99 and more Source cves: CVE-2025-53643 Source advisory: GHSA-9548-QRRJ-X5PJ...

appdaemon (>=3.0.0b2, <=3.0.0b3), balebot (>=1.2.3, <=1.8.15) +4 more potentially affected by CVE-2025-53643 via aiohttp (2.3.7)

aiohttp PYPI version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - appdaemon =3.0.0b2, =1.2.3, =0.61.1, =0.0.1, =0.2.1 - tictax 0.1.3 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

opentrons (>=3.7.0, <=3.11.4) potentially affected by CVE-2025-53643 via aiohttp (2.3.8)

aiohttp PYPI version 2.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - opentrons =3.7.0, =3.11.4 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

0x20bf (0.0.1), 2keys (0.5.1) +2948 more potentially affected by CVE-2025-53643 via aiohttp (>=3.0.0b0, <=3.12.13)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.0, =0.1.0b0, =1.0.99 and more Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

0x20bf (0.0.1), 2keys (0.5.1) +2948 more potentially affected by CVE-2025-53643 via aiohttp (>=3.0.0b0, <=3.12.13)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.0, =0.1.0b0, =1.0.99 and more Source cves: CVE-2025-53643 Source advisory: SNYK:PYTHON-AIOHTTP-10742466...

hdx-data-freshness (>=1.0.5, <=1.1.2), pyplanet (>=0.6.0rc1, <=0.10.5) potentially affected by CVE-2025-53643 via aiohttp (2.3.9)

aiohttp PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hdx-data-freshness =1.0.5, =0.6.0rc1, =0.10.5 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

muffin (>=0.6.0, <=0.6.1) potentially affected by CVE-2025-53643 via aiohttp (0.21.2)

aiohttp PYPI version 0.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.6.0, =0.6.1 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

muffin (>=0.3.3, <=0.3.7) potentially affected by CVE-2025-53643 via aiohttp (0.18.4)

aiohttp PYPI version 0.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.3, =0.3.7 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

muffin (>=0.0.23, <=0.0.45) potentially affected by CVE-2025-53643 via aiohttp (0.14.4)

aiohttp PYPI version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.23, =0.0.45 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

muffin (0.5.1) potentially affected by CVE-2025-53643 via aiohttp (0.20.1)

aiohttp PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.1 Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...