HTTP Request Smuggling

aiohttp is vulnerable to HTTP Request Smuggling. The vulnerability exists due to various issues with header parsing in httpparser.py. This allows a remote attacker to smuggle an HTTP request by submitting a maliciously crafted header. This is impactful when AIOHTTPNOEXTENSIONS is enabled or when...

Design/Logic Flaw

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...