poc-cve-2024-23334

poc-cve-2024-23334 This repository contains a proof of concept about the exploitation of the aiohttp library for the reported vulnerability CVE-2024-23334. This was created for two reasons: 1. Educational purposes: for those who are starting in application security, it is helpful to see the steps...

CLSA-2026-1791528872 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.4.post16+tuxcare...

Aiohttp HTTP Client DoS

The vulnerability of the Aiohttp HTTP client is related to the allocation of unlimited memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Aiohttp HTTP Client DoS

The vulnerability of the Aiohttp HTTP client is related to the improper processing of highly compressed input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Aiohttp HTTP Client Source Verification Confidential Data Access

The vulnerability of the Aiohttp HTTP client is related to a lack of mechanisms for verifying the source of the connection. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential data...

Aiohttp HTTP Client CRLF DoS

The vulnerability of the Aiohttp HTTP client is related to the lack of measures taken to neutralize CRLF sequences. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Aiohttp HTTP Client DoS

The vulnerability of the Aiohttp HTTP client is related to the allocation of unlimited memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Aiohttp HTTP client Host Certificate DOSS

The vulnerability of the Aiohttp HTTP client is related to the lack of checking host certificate data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Aiohttp HTTP Client Unauthorized Access

The vulnerability of the Aiohttp HTTP client is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Aiohttp Memory Initialization Error DoS

The vulnerability of the Aiohttp HTTP client is related to memory initialization errors. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Aiohttp HTTP Client Resource Leak DoS

The vulnerability of the Aiohttp HTTP client is related to errors during resource release. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Aiohttp HTTP Client DoS

The vulnerability of the Aiohttp HTTP client is related to the allocation of unlimited memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

CLSA-2026-1791459385 TuxCare security update for aiohttp (2 CVEs)

TuxCare rebuilt aiohttp to address 2 CVEs. Fixed in 3.8.4.post15+tuxcare...

CLSA-2026-1791456836 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.5.post19+tuxcare...

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summary praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches...

GHSA-7C92-X8VG-4258 PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents Summary praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches...

CLSA-2026-1791377424 TuxCare security update for aiohttp (7 CVEs)

TuxCare rebuilt aiohttp to address 7 CVEs. Fixed in 3.8.1.post16+tuxcare...

CLSA-2026-1791373745 TuxCare security update for aiohttp (5 CVEs)

TuxCare rebuilt aiohttp to address 5 CVEs. Fixed in 3.8.4.post14+tuxcare...

CLSA-2026-1791372571 TuxCare security update for aiohttp (5 CVEs)

TuxCare rebuilt aiohttp to address 5 CVEs. Fixed in 3.8.5.post18+tuxcare...

PT-2026-107649

Name of the Vulnerable Software and Affected Versions praisonai versions 4.5.128 through 4.6.62 Description The AgentMail webhook mode in praisonai exposes a public aiohttp endpoint that accepts message.received JSON payloads without verifying Svix webhook signatures. This allows an attacker to...