Checkov: aiohttp has vulnerable dependency that is vulnerable to request smuggling
Affects checkovSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 2.5.10
Data as of 26 Oct 2026, 16:20 UTC
What to do
Upgrade checkov to 2.5.10.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Homebrewcheckovpkg:brew/checkovOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade aiohttp to version 3.8.6 or later, which includes llhttp 9 or newer, resolving the vulnerabilities. For Checkov, upgrade to a version that uses aiohttp 3.8.6+ or later. Since a patch is available, applying the official fix is the recommended mitigation.
Description
The llhttp library version 8.1.1 contains two request smuggling vulnerabilities. These vulnerabilities affect aiohttp versions prior to 3.8.6 because they include the vulnerable llhttp version. The vulnerabilities are resolved by upgrading to llhttp version 9 or later, which is included in aiohttp 3.8.6 and above. The affected product Checkov uses aiohttp versions from 2.0.615 up to but not including 2.5.10, which rely on the vulnerable llhttp version. No detailed technical information or exploitation details have been disclosed yet.
References
- github.com/aio-libs/aiohttp/security/advisories/GHSA-pjjw-qhg8-p2p9 (opens in a new tab)
- github.com/aio-libs/aiohttp/commit/996de2629ef6b4c2934a7c04dfd49d0950d4c43b (opens in a new tab)
- github.com/aio-libs/aiohttp/commit/bcc416e533796d04fb8124ef1e7686b1f338767a (opens in a new tab)
- github.com/aio-libs/aiohttp (opens in a new tab)