aio-libs Async HTTP client/server framework Resource management error vulnerability

The aio-libs Async HTTP client/server framework, versions 2.0.0 to 3.14.4, has a resource management vulnerability. This vulnerability stems from the handling of multipart requests, which retains an unlimited number of open file descriptors. When the processing program uses Request.post,...

aio-libs Async HTTP client/server framework Resource management error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a resource management error vulnerability. This vulnerability stems from the Max-Age mechanism, which may cause overflows and skip closing connections. This could allow attackers to temporarily exhaust the connection po...

aio-libs Async HTTP client/server framework – Session mechanism-related vulnerabilities

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a security vulnerability. This vulnerability stems from the lack of enforcing the Secure attribute for shared cookies. As a result, shared cookies marked as Secure may be sent via unencrypted requests...

aio-libs Async HTTP client/server framework – Session mechanism-related vulnerabilities

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a session mechanism vulnerability. This vulnerability stems from the Host-Only scope, which allows the removal of cookies from the parent domain. Accessing untrusted subdomains may result in the Host-Only protection of...

aio-libs Async HTTP client/server framework Resource management error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a resource management error vulnerability. This vulnerability stems from the lack of keepalive timeout handling during the initial request phase. Attackers can keep idle connections open without sending request data,...

aio-libs Async HTTP client/server framework: Input validation error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a vulnerability related to input validation errors. This vulnerability stems from the use of a pure Python parser that accepts ambiguous HTTP request frames. This could allow unvalidated attackers to inject HTTP request...

aio-libs Async HTTP client/server framework: Input validation error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a vulnerability related to input validation errors. This vulnerability arises when an attacker can send an absolute-form request, causing Request.scheme to use the request-target scheme data controlled by the attacker...

PYSEC-2026-4244 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The...

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

DescriptionA reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The reflected-uni...

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The...

GHSA-54P9-H82J-F925 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The...

Security Bulletin: Vulnerability in aio-libs aiohttp affects IIBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.

Summary Potential vulnerability in aio-libs aiohttp has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.. The vulnerability have been addressed. Refer to details for additional information...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in aio-libs aiohttp

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of aio-libs aiohttp Vulnerability Details CVEID:CVE-2024-30251 DESCRIPTION: aio-libs aiohttp is vulnerable to a denial of service, caused by an infinite loop flaw. By sending specially crafted POST requests, a remote attacker...

Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities

Summary QRadar Suite Software includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version. Vulnerability Details...

CVE-2023-37276

A flaw was found in aio-libs aiohttp, where it is vulnerable to HTTP request smuggling, caused by a flaw in the aiohttp.web.Application. By sending a specially crafted HTTPS request, an attacker can poison the web cache, bypass web application firewall protection, and conduct Cross-site scripting...

CVE-2018-1000814

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

CVE-2018-1000814

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

CVE-2018-1000814

CVE-2018-1000814 affects aiohttp-session versions 2.6.0 and earlier. The vulnerability lies in EncryptedCookieStorage and NaClCookieStorage, allowing non-expiring (infinite) sessions. Exploitation described as recreation of a cookie post-expiry with the same value; no explicit fixes are provided ...

CVE-2018-1000814: Insufficient Session Expiration

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value...

Session fixation

aio-libs aiohttp-session contains a Session Fixation vulnerability in loadsession function for RedisStorage see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttpsession/redisstorage.pyL42 that can result in Session Hijacking. This attack appear to be exploitable via Any method that...