CVE-2025-69226: Improper Limitation of a Pathname to a Restricted Directory

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses...

PT-2026-1348

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 3.13.2 and below Description AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, is susceptible to a denial-of-service DoS attack. An attacker can send a compressed request, specifically a zip bomb,...

PT-2026-1349

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 3.13.2 and below Description AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, may be susceptible to a request smuggling attack when using versions 3.13.2 and below. This issue arises from the...

PT-2026-1350

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 3.13.2 and below Description AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, has an issue in its parser logic. The parser allows non-ASCII decimals to be present in the Range header. This could...

PT-2026-1351

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 3.13.2 and below Description AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, has an issue where versions 3.13.2 and below allow an attacker to determine the existence of absolute path components...

PT-2026-1355

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 3.13.2 and below Description AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Handling of chunked messages in versions 3.13.2 and below can lead to excessive blocking CPU usage when receiving a...

PT-2026-1354

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 3.13.2 and below Description AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below are susceptible to a denial of service condition. An attacker can craft a request that caus...

CVE-2025-69223: Improper Handling of Highly Compressed Data (Data Amplification)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory...

CVE-2025-69224: Inconsistent Interpretation of HTTP Requests

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed i.e. without the usual C extensions ...

aiohttp environmental issue vulnerabilities

aiohttp is an open source asynchronous HTTP client/server framework for asyncio and Python from aio-libs open source. An environment issue vulnerability exists in aiohttp 3.13.2 and earlier versions, which stems from the presence of non-ASCII characters that could allow a request entrapment attac...

Security Bulletin: Vulnerability in AIOHTTP affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in AIOHTTP has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabili...

aiohttp HTTP Client

The vulnerability of the aiohttp HTTP client is related to the inconsistent interpretation of HTTP requests. Exploiting this vulnerability allows an attacker who operates remotely to carry out attacks by replacing HTTP requests with malicious content...

Low: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.7

Red Hat OpenShift Service Mesh 3.0.7 Red Hat OpenShift Service Mesh 3.0.7, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Security Fixes: istio-proxyv2-rhel9: AIOHTTP is...

MAL-2025-191702 Malicious code in chromifypro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4138883ad2e38b4a8a4353918126f4732db5f04107be0bddafc745ec97120b52 Packages silently decrypt content hidden in a dependency and load them as Python extension modules. In the first wave, those are copies of legitimate aiohttp a...

Malicious code in chromifypro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4138883ad2e38b4a8a4353918126f4732db5f04107be0bddafc745ec97120b52 Packages silently decrypt content hidden in a dependency and load them as Python extension modules. In the first wave, those are copies of legitimate aiohttp a...

arches (>=6.2.5, <=7.4.2), botbuilder-applicationinsights (>=0.0.1, <=4.14.8) +3 more potentially affected by CVE-2025-64458 via django (3.2.21)

django PYPI version 3.2.21 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - arches =6.2.5, =0.0.1, =0.0.1, =2024.5.0, =2024.6.0 - nemo 4.6.4 Source cves: CVE-2025-64458 Source advisory: OSV:GHSA-QW25-V68C-QJF3...

alcali (>=2018.3.2, <=2019.2.2), botbuilder-applicationinsights (>=4.7.0, <=4.14.2) +4 more potentially affected by CVE-2025-64459 via django (2.2.6)

django PYPI version 2.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.2, =4.7.0, =4.10.0, =4.14.2 - kiwitcms 7.1.0 - ls-orb 0.1.0 - wazimap 2.1.0 Source cves: CVE-2025-64459 Source advisory:...

alcali (>=2018.3.2, <=2019.2.2), botbuilder-applicationinsights (>=4.7.0, <=4.14.2) +4 more potentially affected by CVE-2025-64458 via django (2.2.6)

django PYPI version 2.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.2, =4.7.0, =4.10.0, =4.14.2 - kiwitcms 7.1.0 - ls-orb 0.1.0 - wazimap 2.1.0 Source cves: CVE-2025-64458 Source advisory:...

MAL-2025-191617 Malicious code in aiohttp-openssl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 67b219a81e6b2dd7db78b4b223da914ee7baefd0ab056940d3af0bc3b47846a0 Packages silently decrypt content hidden in a dependency and load them as Python extension modules. In the first wave, those are copies of legitimate aiohttp a...

Malicious code in aiohttp-openssl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 67b219a81e6b2dd7db78b4b223da914ee7baefd0ab056940d3af0bc3b47846a0 Packages silently decrypt content hidden in a dependency and load them as Python extension modules. In the first wave, those are copies of legitimate aiohttp a...