A vulnerability in setuptools on Windows allows a crafted wheel's namespace_packages.txt to cause legacy wheel installation to create an __init__.py file outside the intended installation directory. The attacker can control the destination path of this file but not its contents. This occurs because an absolute Windows path in namespace_packages.txt is not properly validated and causes path joining to resolve outside the target directory.
Multiple vulnerabilities in aiohttp versions 3.4 up to but not including 3.4_4 allow an attacker to cause excessive or unbounded memory and CPU usage via specially crafted requests, leading to resource exhaustion.
AIOHTTP's pure Python HTTP parser is vulnerable to an HTTP request smuggling attack when used instead of the default C parser. This affects versions from 3.4 up to but not including 3.4_4. The vulnerability can be mitigated by switching to the default C parser or upgrading to version 3.4_4 or later where the issue is fixed.
CVE-2026-111749 is a vulnerability in AIOHTTP where a subdomain can remove the Host-Only flag from an existing cookie set for a parent domain. This could allow cookies that were intended to be restricted to the host to become accessible more broadly. The impact is limited because most use cases do not reflect these cookies back to a browser, reducing the risk of exploitation.
CVE-2026-111748 is a vulnerability in AIOHTTP where an attacker can send an absolute-form HTTP request to spoof the Request.scheme attribute. This can mislead applications relying on this attribute for security decisions, potentially causing them to incorrectly assume a connection is encrypted or not. The issue affects AIOHTTP versions from 3.4 up to but not including 3.4_4. A patch is available in version 3.4_4. A workaround involves using a WAF rule to block absolute-form requests, which are typically only legitimate for proxy use.
A buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms. This flaw allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. Fixed versions include 1.0.10, 1.1.1, and 1.2.1.
AIOHTTP versions from 3.4 up to but not including 3.4_4 contain a vulnerability where specially crafted multipart requests can exhaust file descriptors. This occurs if a handler uses the Request.post() method, potentially leading to resource exhaustion due to unlimited file descriptor usage. The issue has been fixed in version 3.4_4.
AIOHTTP versions from 3.4 up to but not including 3.4_4 contain a vulnerability where an overflow in Max-Age processing can prevent connections from closing properly. This can lead to temporary exhaustion of the connection pool until garbage collection frees the connections. The issue is fixed in version 3.4_4.
The aiohttp server did not enforce a timeout during the initial request or header phase, allowing an attacker to keep an idle connection open indefinitely before sending any data. This issue was addressed in version 3.4_4. The vulnerability has a high severity score of 8.2. A recommended workaround is to use a reverse proxy with sensible keepalive limits.
AIOHTTP versions from 3.4 up to but not including 3.4_4 do not enforce the Secure attribute on shared cookies. This flaw allows a shared cookie marked Secure to be transmitted over unencrypted HTTP requests, potentially exposing it to interception.
Soupsieve, a CSS selector parsing library used by BeautifulSoup, contains a regular expression vulnerability causing polynomial-time ReDoS (Regular Expression Denial of Service) when processing certain user-controlled selectors. Specifically, the IDENTIFIER and VALUE sub-patterns use adjacent quantified groups over overlapping character classes, leading to O(n²) backtracking on failing matches. This can stall the interpreter for seconds to minutes depending on input size. The issue affects applications that accept user-supplied selectors and use soupsieve or BeautifulSoup's select methods. A fix is available in version 3.4_2.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's whitespace/comment trimming regex RE_WS_END, which is used during CSS selector tokenization. The regex is unanchored at the start and uses .search(), causing quadratic time complexity (O(n²)) on valid selectors with long whitespace or comment runs not exactly at the string end. This can stall the interpreter for seconds on large inputs. The flaw affects soupsieve versions prior to 3.4_2 and is exploitable when user-controlled selectors are passed to soupsieve or BeautifulSoup's select functions.
A Unicode normalization mismatch in setuptools' handling of MANIFEST.in exclusion rules can cause files intended to be excluded from source distributions to be included instead. This occurs on macOS APFS/HFS+ filesystems where filenames are stored in NFD form but MANIFEST.in patterns are typically written in NFC form, causing byte-level matching to fail. As a result, sensitive or private files with non-ASCII names may be unintentionally published to PyPI.