aiohttp < 3.14.3 Out-of-bounds Read DoS

The version of aiohttp installed on the remote host is prior to 3.14.3. It is, therefore, affected by a denial of service vulnerability: - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response pars...

PYSEC-2026-3545 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. Impact An attacker controlled server, or possibly an accidental response could trigger a DoS in the client. Workaround If unable to upgrade, the Python parser is...

CVE-2026-54277 AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the maxlinesize check in parts of an HTTP request in the C parser. If using the optimised C parser the default in pre-built wheels, then an attacker may be able to send...

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

Summary It is possible to bypass the maxlinesize check in parts of an HTTP request in the C parser. Impact If using the optimised C parser the default in pre-built wheels, then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potential...

aiohttp 注入漏洞

aiohttp is an open-source framework developed by aio-libs, used for asynchronous HTTP client/server interactions with asyncio and Python. Prior to version 3.13.4 of AIOHTTP, there was an injection vulnerability; this vulnerability stemmed from the C parser allowing empty bytes and control...