CVE-2024-23334-PoC

CVE-2024-23334-PoC A proof of concept of the path traversal vulnerability in the python AioHTTP library = sudo apt install python3-venv Lab setup git clone https://github.com/z3rObyte/CVE-2024-23334-PoC cd CVE-2024-23334-PoC python3 -m venv .env chmod +x ./.env/bin/activate source...

CVE-2026-128132

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader continues parsing frames already received after the receive queue pauses the transport, and empty messages are not counted toward the queue size. With permessage-deflate, one read...

CVE-2026-128131

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payload containing many concatenated gzip, deflate, or zstd streams by passing the entire remaining input to a new decompressor, causing quadratic CPU use. Empty...

CVE-2026-128124

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Application.adddomain converts every asterisk wildcard in a domain mask into a greedy regular-expression fragment, so a mask containing two or more wildcards can take polynomial time to reject a long...

CVE-2026-128125

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client...

CVE-2026-128127

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.readchunk processing a multipart part with Content-Transfer-Encoding set to base64 keeps reading until the chunk length is a multiple of four without enforcing a byte limit. A short...

CVE-2026-128128

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the C WebSocket reader adds a declared frame length to the size of an already buffered partial message using signed 64-bit arithmetic. A length near two to the power of 63 can overflow, allowing the...

CVE-2026-128129

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can...

CVE-2026-128126

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Request.post does not limit the number of fields in a URL-encoded form body, and inserting many repeated keys into MultiDict takes quadratic time on the event loop. A remote attacker can send a form...

CVE-2026-128130

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, when the pipelined request queue is full, the pure-Python parser stores the unparsed remainder internally and also returns the same data to its caller. After a handler declines an upgrade request, the...

CVE-2024-23334-PoC

CVE-2024-23334-PoC This repository is a proof of concept POC for CVE-2024-23334, demonstrating an attempt to replicate the bug in aiohttp that leads to Local File Inclusion LFI. !CAUTION Disclaimer: This POC is for educational purposes only. DO NOT use it in real-world scenarios. Install 1. Clone...

CVE-2026-128132

The AIOHTTP asynchronous HTTP client/server framework for Python and asyncio is vulnerable to uncontrolled resource consumption in versions prior to 3.14.4 . The root cause is that the WebSocket reader continues parsing frames after the receive queue pauses the transport, while empty messages are...

CVE-2026-128131

The aiohttp asynchronous HTTP client/server framework for asyncio and Python (versions prior to 3.14.4 ) is vulnerable to a quadratic CPU use issue. When processing payloads with concatenated gzip, deflate, or zstd streams, the software passes the entire remaining input to a new decompressor for ...

CVE-2026-128130

The AIOHTTP asynchronous HTTP framework is vulnerable to a request replay and buffer growth issue in versions prior to 3.14.4 . When the pipelined request queue is full, the pure-Python parser stores the unparsed remainder internally while also returning it to the caller. If a handler declines an...

EUVD-2026-125761

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can...

CVE-2026-128129

The AIOHTTP asynchronous HTTP client/server framework for Python is vulnerable to unbounded memory consumption in versions prior to 3.14.4 . The root cause is that the framework buffers additional connection data during an upgrade request (such as a WebSocket handshake) without implementing a siz...

CVE-2026-128129 AIOHTTP: Unbounded buffering of data received during an upgrade request

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can...

CVE-2026-128128

The AIOHTTP asynchronous HTTP framework is vulnerable to an integer overflow in its C WebSocket reader prior to version 3.14.4 . The vulnerability occurs because the reader uses signed 64-bit arithmetic to add a declared frame length to a buffered partial message. A length near $2^{63}$ can cause...

CVE-2026-128127

The AIOHTTP asynchronous HTTP framework for Python and asyncio is vulnerable to a memory exhaustion or event loop spinning issue in versions prior to 3.14.4 . The root cause lies in the BodyPartReader.read_chunk() function, which fails to enforce a byte limit when processing multipart parts with ...

CVE-2026-128126

The AIOHTTP asynchronous HTTP framework for Python and asyncio is vulnerable to a Denial of Service (DoS) condition prior to version 3.14.4 . The Request.post() method fails to limit the number of fields in a URL-encoded form body, allowing an attacker to insert many repeated keys into a MultiDic...