Vdirsyncer: aiohttp has vulnerable dependency that is vulnerable to request smuggling
Affects vdirsyncerSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 0.19.2_4
Data as of 26 Oct 2026, 16:20 UTC
What to do
Upgrade vdirsyncer to 0.19.2_4.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Homebrewvdirsyncerpkg:brew/vdirsyncerOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available by upgrading to aiohttp 3.8.6 or later, which includes llhttp 9+ that resolves the request smuggling vulnerabilities. Users of vdirsyncer should upgrade to version 0.19.2_4 or later where this dependency is updated. No other mitigation actions are indicated.
Description
Vdirsyncer versions from 0.19.0 up to but not including 0.19.2_4 are affected by a vulnerability in a dependency, aiohttp, which uses llhttp 8.1.1. This version of llhttp is vulnerable to two request smuggling vulnerabilities. The issue is resolved by upgrading to llhttp 9 or later, which is included in aiohttp 3.8.6 and newer.
References
- github.com/aio-libs/aiohttp/security/advisories/GHSA-pjjw-qhg8-p2p9 (opens in a new tab)
- github.com/aio-libs/aiohttp/commit/996de2629ef6b4c2934a7c04dfd49d0950d4c43b (opens in a new tab)
- github.com/aio-libs/aiohttp/commit/bcc416e533796d04fb8124ef1e7686b1f338767a (opens in a new tab)
- github.com/aio-libs/aiohttp (opens in a new tab)