1614 matches found
The vulnerability of the aiohttp HTTP client, related to incorrect pathname restrictions for directories, allows attackers to disclose protected information.
The vulnerability of the aiohttp HTTP client is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a remote attacker to disclose sensitive information that is protected by the system...
The vulnerability of the Application.add_domain() function in the aiohttp HTTP client allows a perpetrator to cause a service failure.
The vulnerability of the Application.adddomain function in the HTTP client of aiohttp is related to the use of duplicate headers due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause service failures...
The vulnerability of the aiohttp HTTP client, related to the failure to handle CRLF sequences in HTTP headers, allows attackers to inject arbitrary HTTP headers.
The vulnerability of the aiohttp HTTP client is related to the failure to handle CRLF sequences in HTTP headers when processing the reason parameter. Exploiting this vulnerability allows an attacker who operates remotely to inject arbitrary HTTP headers...
The vulnerability of the HTTP message analyzer for the llhttp HTTP client and aiohttp allows attackers to inject arbitrary HTTP headers and circumvent existing security restrictions.
The vulnerability of the HTTP message analyzer for the llhttp HTTP client and aiohttp is related to the failure to handle CRLF sequences in HTTP headers when processing the reason parameter. Exploiting this vulnerability allows an attacker to inject arbitrary HTTP headers and circumvent existing...
The vulnerability of the Request.post() function in the aiohttp HTTP client allows a attacker to trigger a service failure.
The vulnerability of the Request.post function in the aiohttp HTTP client is related to unlimited resource distribution or throttling. Exploiting this vulnerability could allow a remote attacker to cause service failures...
The vulnerability of the aiohttp HTTP client, related to the failure to handle CRLF sequences in HTTP headers, allows attackers to inject arbitrary HTTP headers.
The vulnerability of the aiohttp HTTP client is related to the failure to handle CRLF sequences in HTTP headers when processing the contenttype parameter. Exploiting this vulnerability allows an attacker to inject arbitrary HTTP headers remotely...
The vulnerability of the aiohttp HTTP client, related to insufficient protection of service data, allows attackers to disclose the protected information.
The vulnerability of the aiohttp HTTP client is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the protected information...
The vulnerability of the aiohttp HTTP client, related to unlimited resource distribution or throttling, allows attackers to cause service failures.
The vulnerability of the aiohttp HTTP client is related to unlimited resource allocation or throttling. Exploiting this vulnerability can allow a remote attacker to cause service failures...
The vulnerability of the aiohttp HTTP client, related to uncontrolled resource consumption, allows attackers to trigger a service failure.
The vulnerability of the aiohttp HTTP client is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
The vulnerability of the TCPConnector HTTP-client library aiohttp, which allows a hacker to trigger a service failure.
The vulnerability of the TCPConnector HTTP-client library from aiohttp is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...
AIOHTTP vulnerable to denial of service through large payloads
SummaryA request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing. ImpactIf an application includes a handler that uses the Request.post method, an attacker may be able to freeze the server by exhausting the memory.-----Patch:...
AIOHTTP vulnerable to DoS through chunked messages
SummaryHandling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. ImpactIf an application makes use of the request.read method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU ti...
PYSEC-2026-1106 AIOHTTP vulnerable to DoS through chunked messages
Summary Handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. Impact If an application makes use of the request.read method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU...
PYSEC-2026-1105 AIOHTTP Vulnerable to Cookie Parser Warning Storm
Summary Reading multiple invalid cookies can lead to a logging storm. Impact If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header. ---- Patch:...
PYSEC-2026-1100 AIOHTTP vulnerable to denial of service through large payloads
Summary A request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing. Impact If an application includes a handler that uses the Request.post method, an attacker may be able to freeze the server by exhausting the memory. ----- Patch:...
AIOHTTP Vulnerable to Cookie Parser Warning Storm
SummaryReading multiple invalid cookies can lead to a logging storm. ImpactIf the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.----Patch:...
PYSEC-2026-1107 AIOHTTP vulnerable to DoS when bypassing asserts
Summary When assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body. Impact If optimisations are enabled -O or PYTHONOPTIMIZE=1, and the application includes a handler that uses the Request.post method, then an attacker may be able to...
AIOHTTP's unicode processing of header values could cause parsing discrepancies
SummaryThe Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. ImpactIf a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execute a request smuggling...
AIOHTTP has unicode match groups in regexes for ASCII protocol elements
SummaryThe parser allows non-ASCII decimals to be present in the Range header. ImpactThere is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.----Patch:...
PYSEC-2026-1097 AIOHTTP vulnerable to brute-force leak of internal static file path components
Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components. Impact If an application uses web.static not recommended for production deployments, it may be possible for an attacker to ascertai...