AIOHTTP: Pure-Python parser request smuggling

Summary The pure Python parser is vulnerable to an HTTP request smuggling attack. Impact If users are using the Python parser AIOHTTPNOEXTENSIONS, or not a standard wheel installed, then an application may be vulnerable to a request smuggling attack. Workaround Switch to the default C parser...

GHSA-PQXQ-W44R-73XW AIOHTTP: Pure-Python parser request smuggling

Summary The pure Python parser is vulnerable to an HTTP request smuggling attack. Impact If users are using the Python parser AIOHTTPNOEXTENSIONS, or not a standard wheel installed, then an application may be vulnerable to a request smuggling attack. Workaround Switch to the default C parser...

CVE-2026-111750

A flaw was found in aiohttp. When running with the pure Python parser instead of compiled extensions, the parser accepts ambiguous HTTP Hypertext Transfer Protocol request framing. An unauthenticated remote attacker could exploit this flaw by sending specially crafted requests through an...

CVE-2026-111750 AIOHTTP: Pure-Python parser request smuggling

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...

CVE-2026-111750 AIOHTTP: Pure-Python parser request smuggling

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...

PT-2026-117520

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4 Description The pure Python parser in this asynchronous HTTP client/server framework accepts ambiguous HTTP request framing. This allows an unauthenticated attacker to perform request smuggling when an...

CVE-2025-69224

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed i.e. without the usual C extensions ...