Airshare: aiohttp has vulnerable dependency that is vulnerable to request smuggling
Affects airshareSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 0.1.6_7
Data as of 26 Oct 2026, 16:20 UTC
What to do
Upgrade airshare to 0.1.6_7.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Homebrewairsharepkg:brew/airshareOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade Airshare to a version that uses aiohttp 3.8.6 or later, which includes llhttp 9 or higher where the vulnerabilities are resolved. Since a patch is available, applying this official fix is the recommended remediation.
Description
The Airshare product includes a vulnerable version of the aiohttp dependency, which relies on llhttp 8.1.1. This version of llhttp is affected by two request smuggling vulnerabilities. The vulnerabilities have not been publicly detailed yet. The issue is resolved by upgrading to llhttp version 9 or higher, which is included starting with aiohttp 3.8.6. The affected Airshare versions are from 0.1.5 up to but not including 0.1.6_7.
References
- github.com/aio-libs/aiohttp/security/advisories/GHSA-pjjw-qhg8-p2p9 (opens in a new tab)
- github.com/aio-libs/aiohttp/commit/996de2629ef6b4c2934a7c04dfd49d0950d4c43b (opens in a new tab)
- github.com/aio-libs/aiohttp/commit/bcc416e533796d04fb8124ef1e7686b1f338767a (opens in a new tab)
- github.com/aio-libs/aiohttp (opens in a new tab)