CVE-2025-53643 AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed i.e. without the...

aba-cli-scrapper (>=0.1.1 <=0.1.6), academic-metrics (>=0.1.0b0 <=1.0.99) +905 more potentially affected by CVE-2025-53643 via aiohttp (>=3.0.0b0 <=3.12.13)

aiohttp PYPI version =3.0.0b0, =0.1.1, =0.1.0b0, =1.1.0, =0.0.0, =0.0.2, =4.8.2, =0.0.3, =56.0.0, =0.1.0, =0.1.31, =1.0.1, =1.2.0 - ahttp-client =1.0.3 and more Source cves: CVE-2025-53643 Source advisory: SNYK:PYTHON-AIOHTTP-10742466...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via incorrect parsing of the trailer section in HTTP requests. An attacker can bypass firewall or proxy protections by crafting specially formed HTTP requests. Note: This is exploitable if the pure Python version ...

aba-cli-scrapper (>=0.1.1 <=0.1.6), academic-metrics (>=0.1.0b0 <=1.0.99) +1034 more potentially affected by CVE-2025-53643 via aiohttp (>=0.13.1 <=3.12.13)

aiohttp PYPI version =0.13.1, =0.1.1, =0.1.0b0, =1.1.0, =0.0.0, =0.0.2, =4.8.2, =0.0.3, =56.0.0, =0.1.0, =0.1.31, =1.0.1, =1.2.0 - ahttp-client =1.0.3 and more Source cves: CVE-2025-53643 Source advisory: OSV:GHSA-9548-QRRJ-X5PJ...

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

Summary The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. Impact If a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execu...

The vulnerability of the aiohttp HTTP client, related to issues with symbolic links when processing static routes that contain files with compressed variants in the FileResponse class, allows a hacker to compromise the vulnerable system.

The vulnerability of the aiohttp HTTP client is related to problems with symbolic links when processing static routes that contain files with compressed variants in the FileResponse class. Exploiting this vulnerability can allow an attacker to compromise the vulnerable system remotely...

Linux Distros Unpatched Vulnerability : CVE-2023-37276

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is us...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in aiohttp

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of aiohttp Vulnerability Details CVEID:CVE-2024-27306 DESCRIPTION: aio-libs aiohttp is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerabili...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in aiohttp

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of aiohttp Vulnerability Details CVEID:CVE-2024-42367 DESCRIPTION: aio-libs aiohttp ould allow a remote attacker to traverse directories on the system, caused by improper archive file validation. An attacker could use a...

Security Bulletin: IBM Maximo Application Suite Predict Component uses CVE-2024-52304 (Low) detected in aiohttp-3.9.2-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl which is vulnerable to CVE-2024-52304

Summary IBM Maximo Application Suite Predict Component uses CVE-2024-52304 Low detected in aiohttp-3.9.2-cp39-cp39-manylinux217x8664.manylinux2014x8664.whl which is vulnerable to CVE-2024-52304. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details...

Exploit for Path Traversal in Aiohttp

CVE-2024-23334-PoC A proof of concept of the path travers...

airflow-tools (>=0.9.0 <=0.9.1) potentially affected by CVE-2024-12254 via aiohttp (=3.11.0rc2)

aiohttp PYPI version =3.11.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - airflow-tools =0.9.0, =0.9.1 Source cves: CVE-2024-12254 Source advisory: SNYK:PYTHON-AIOHTTP-8492046...

aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

A flaw was found in the aiohttp package. The Python parser parses newlines in chunk extensions incorrectly, which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed, for example, without the usual C extensions, or...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

The vulnerability of the aiohttp HTTP client lies in the fact that resources are not released after their useful period has ended, allowing attackers to trigger service failures.

The vulnerability of the aiohttp HTTP client is related to the failure to release resources after their useful period has expired. Exploiting this vulnerability allows a remote attacker to cause service failures...

Memory Leakage

aiohttp is vulnerable to Memory Leakage. The vulnerability is due to improper handling of MatchInfoError, where each error creates a unique cache entry, allowing an attacker to exhaust server memory with numerous requests...

HTTP Request Smuggling

aiohttp is vulnerable to HTTP Request Smuggling. The vulnerability is due to incorrect parsing of newlines in chunk extensions via the feeddata function by which an attacker can bypass firewall or proxy protections by sending specially crafted requests...

aioHTTP < 3.10.11 Request Smuggling

The version of aioHTTP installed on the remote host is prior to 3.10.11. It is, therefore, affected by a request smuggling vulnerability. aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions...

act-workflow (>=4.8.2 <=4.8.399), ahserver (>=1.0.1 <=1.2.0) +253 more potentially affected by CVE-2024-52304 via aiohttp (>=0.13.1 <=3.10.10)

aiohttp PYPI version =0.13.1, =4.8.2, =1.0.1, =0.48.0, =0.60.2, =0.9.0, =0.1.1, =0.9.2, =1.1.0, =0.2.3, =0.1.0, =3.2.4b1, =0.3.0, =0.5.1 and more Source cves: CVE-2024-52304 Source advisory: OSV:GHSA-8495-4G3G-X7PR...

act-workflow (>=4.8.2 <=4.8.399), ahserver (>=1.0.1 <=1.2.0) +120 more potentially affected by CVE-2024-52304 via aiohttp (>=3.0.0b0 <=3.10.10)

aiohttp PYPI version =3.0.0b0, =4.8.2, =1.0.1, =0.48.0, =0.60.2, =0.9.0, =0.9.0, =0.1.19, =24.8.0, =0.1.6, =0.9.0, =0.9.1 - atlan-application-sdk =1.0.1 - backend-ai =1.3.0 and more Source cves: CVE-2024-52304 Source advisory: SNYK:PYTHON-AIOHTTP-8383923...