The pure Python HTTP parser used in AIOHTTP versions 3.4.2 up to but not including 3.10.0 is vulnerable to HTTP request smuggling attacks. This vulnerability affects applications using the Python parser, typically when the environment variable AIOHTTP_NO_EXTENSIONS is set or when a non-standard wheel is installed. The issue is resolved in version 3.10.0 by switching to the default C parser.
Multiple vulnerabilities in aiohttp versions 3.4.2 up to but not including 3.10.0 allow an attacker to cause excessive or unbounded memory and CPU usage via specially crafted requests, leading to resource exhaustion.
A vulnerability in AIOHTTP allows a subdomain to remove the Host-Only flag from an existing cookie set for a parent domain. This could lead to reduced cookie security protections when users access untrusted subdomains. However, the impact is limited because most use cases do not reflect these cookies back to browsers.
CVE-2026-111748 is a vulnerability in pferd versions 3.4.2 up to but not including 3.10.0 where an attacker can spoof the Request.scheme attribute by sending an absolute-form HTTP request. This can mislead applications relying on Request.scheme for security decisions, potentially causing them to misinterpret whether a connection is encrypted. A workaround is to use a WAF rule to reject absolute-form requests, which are typically only legitimate for proxies. A fix is available in version 3.10.0.
CVE-2026-111066 is a vulnerability in the pferd product affecting versions from 3.4.2 up to but not including 3.10.0. It allows an attacker to exhaust file descriptors by sending specially crafted multipart requests to handlers using Request.post(), potentially causing resource exhaustion. A fix is available in version 3.10.0.
AIOHTTP versions from 3.4.2 up to but not including 3.10.0 contain a vulnerability where an overflow in Max-Age processing can cause connections to remain open, leading to temporary exhaustion of the connection pool. This issue is fixed in version 3.10.0.
The Pferd aiohttp server versions from 3.4.2 up to but not including 3.10.0 lack an initial request/header timeout, allowing an attacker to keep an idle connection open indefinitely before sending any data. This issue has been fixed in version 3.10.0. The vulnerability has a high severity with a CVSS score of 8.2. A recommended workaround is to use a reverse proxy with sensible keepalive limits.
A vulnerability in AIOHTTP allows the Secure attribute of a shared cookie to be ignored, potentially causing the cookie to be sent over unencrypted requests. This affects versions from 3.4.2 up to but not including 3.10.0. The issue is fixed in version 3.10.0.
CVE-2026-104874 is a memory leak vulnerability in the items-view union and subtraction operators of the aio-libs/multidict library versions 6.7.0 through 6.9.0. The flaw causes unbounded memory growth by leaking references to key-identity and value objects during certain set operations on dictionary views. This leak occurs because the code fails to release new strong references created during parsing, leading to unreclaimable memory usage that grows until the process is terminated.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parsing due to a quadratic-time regex backtracking issue in the IDENTIFIER and VALUE sub-patterns. This flaw can cause the regex engine to consume excessive CPU time when processing specially crafted selectors that fail to match, such as unterminated attribute values or invalid trailing characters. The vulnerability is exploitable when user-controlled CSS selectors are passed to soupsieve or BeautifulSoup's select methods. It affects soupsieve versions from 3.4.2 up to but not including 3.9.3. A fix is available in version 3.9.3.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's whitespace/comment trimming regex `RE_WS_END`. The regex is used unanchored with `.search()`, causing quadratic time complexity (O(n²)) on valid CSS selectors with long whitespace or comment runs. This can stall the interpreter for seconds on large inputs. The issue affects soupsieve versions from 3.4.2 up to but not including 3.9.3 and is fixed in 3.9.3.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parser due to a regex pattern that suffers catastrophic backtracking when processing attribute selectors with unterminated quoted values. This flaw allows an attacker to cause significant CPU consumption and thread blocking with a small payload of about 300 bytes. The issue affects soupsieve versions from 3.4.2 up to but not including 3.9.2_1 and has been assigned CVE-2026-49477. A fix is available in version 3.9.2_1.
A memory exhaustion vulnerability exists in soupsieve's CSS selector parser used by Beautiful Soup 4. The parser allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker to cause denial of service by supplying a crafted CSS selector string. A 500 KB input can cause approximately 244 MB of heap memory allocation, leading to potential out-of-memory conditions or process termination.