muffin (0.5.0) potentially affected by CVE-2024-52304 via aiohttp (0.20.0)

aiohttp PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.0 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

muffin (>=0.4.0, <=0.4.2) potentially affected by CVE-2024-52304 via aiohttp (0.19.0)

aiohttp PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.4.0, =0.4.2 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

s2aio (>=1.12.0, <=1.14.0) potentially affected by CVE-2024-52304 via aiohttp (0.22.4)

aiohttp PYPI version 0.22.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - s2aio =1.12.0, =1.14.0 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

aiobotocore (0.2.3), aiobotocore-botorange (>=0.1.0, <=0.2.3a0) +9 more potentially affected by CVE-2024-52304 via aiohttp (1.3.5)

aiohttp PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiobotocore 0.2.3 - aiobotocore-botorange =0.1.0, =0.0.3a0, =1.2.0, =1.0.0, =3.0.2, =3.0.5 Source cves: CVE-2024-52304 Source advisory:...

muffin (>=0.10.0, <=0.10.2), mutaprops (>=0.6.0, <=0.6.1) potentially affected by CVE-2024-52304 via aiohttp (1.0.2)

aiohttp PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.10.0, =0.6.0, =0.6.1 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

muffin (0.5.1) potentially affected by CVE-2024-52304 via aiohttp (0.20.1)

aiohttp PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin 0.5.1 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

SummaryA memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. ImpactIf the user is making use of any middlewares with aiohttp.web then it is advisab...

PYSEC-2026-1096 aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

Summary A memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. Impact If the user is making use of any middlewares with aiohttp.web then it is...

homeassistant (>=0.38.0, <=0.38.4), okami (>=0.1.2, <=0.1.3) +1 more potentially affected by CVE-2024-52304 via aiohttp (1.3.1)

aiohttp PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.38.0, =0.1.2, =0.1.3 - pyatv 0.1.4 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

aiogremlin (>=3.2.4b1, <=3.2.5), goblin (2.0.0b1) +3 more potentially affected by CVE-2024-52304 via aiohttp (1.3.3)

aiohttp PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin =3.2.4b1, =0.39.0, =1.0.0b1, =1.0.0b2 - okami 0.1.4 Source cves: CVE-2024-52304 Source advisory: OSV:PYSEC-2026-1103...

alcali (>=2018.3.2, <=2019.2.2), botbuilder-applicationinsights (>=4.7.0, <=4.14.2) +4 more potentially affected by CVE-2024-45231 via django (2.2.6)

django PYPI version 2.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.2, =4.7.0, =4.10.0, =4.14.2 - kiwitcms 7.1.0 - ls-orb 0.1.0 - wazimap 2.1.0 Source cves: CVE-2024-45231 Source advisory:...

aio-overpass (>=0.9.0, <=0.11.0), aio-taginfo (0.2.0) +22 more potentially affected by CVE-2024-42367 via aiohttp (>=3.10.0rc0, <=3.10.1)

aiohttp PYPI version =3.10.0rc0, =0.9.0, =24.8.0, =0.2.0, =0.0.1, =1.1.6, =1.0.2, =1.0.1, =24.8.0, =6.1.0, =0.1.0, =0.9.73, =7.4.0, =7.4.1 and more Source cves: CVE-2024-42367 Source advisory: OSV:PYSEC-2026-1108...

PYSEC-2026-1108 In aiohttp, compressed files as symlinks are not protected from path traversal

Summary Static routes which contain files with compressed variants .gz or .br extension were vulnerable to path traversal outside the root directory if those variants are symbolic links. Details The server protects static routes from path traversal outside the root directory when...

In aiohttp, compressed files as symlinks are not protected from path traversal

SummaryStatic routes which contain files with compressed variants .gz or .br extension were vulnerable to path traversal outside the root directory if those variants are symbolic links. DetailsThe server protects static routes from path traversal outside the root directory when followsymlinks=Fal...

hugo-jupyter (>=0.2.1, <=0.3.0), modconf (>=0.4.0b7, <=0.4.0b9) +3 more potentially affected by CVE-2024-6345 via setuptools (36.2.0)

setuptools PYPI version 36.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - hugo-jupyter =0.2.1, =0.4.0b7, =0.5.0b10, =0.5.0b12 - ws-sheets-server 0.4.1b28 - ws-web-aiohttp 0.1.0b19 Source cves: CVE-2024-6345 Source...

PYSEC-2026-1098 aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests

Summary An attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. Impact An attacker can stop the application from serving requests after sending a single...

aiopogo (>=2.0.1, <=2.1.0b0), aiosparql (>=0.0.0, <=0.10.0a3) +6 more potentially affected by CVE-2024-30251 via aiohttp (2.1.0)

aiohttp PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiopogo =2.0.1, =0.0.0, =0.46.0, =0.4.0, =0.0.2, =0.4.4 Source cves: CVE-2024-30251 Source advisory: OSV:PYSEC-2026-1098...

ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2024-30251 via aiohttp (2.2.3)

aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2024-30251 Source...

botstory (0.0.63) potentially affected by CVE-2024-30251 via aiohttp (2.0.1)

aiohttp PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory 0.0.63 Source cves: CVE-2024-30251 Source advisory: OSV:PYSEC-2026-1098...

iamine (>=0.1.5, <=0.1.6) potentially affected by CVE-2024-30251 via aiohttp (0.13.1)

aiohttp PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - iamine =0.1.5, =0.1.6 Source cves: CVE-2024-30251 Source advisory: OSV:PYSEC-2026-1098...