Threats affecting pkg:pypi/aiohttp

CVE-2026-111750 is a medium severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.4 use a pure Python HTTP parser that accepts ambiguous HTTP request framing, allowing an unauthenticated attacker to perform HTTP request smuggling when the application runs without standard wheel extensions or uses AIOHTTP_NO_EXTENSIONS. This issue is fixed in version 3.14.4.

CVE-2026-111749 is a low-severity vulnerability in aiohttp prior to version 3.14.4 where a subdomain can remove the Host-Only scope from an existing parent-domain cookie. This can lead to host-only protections being stripped from cookies if a user accesses an untrusted subdomain. The impact is limited when applications do not reflect these cookies to browsers. The issue is fixed in aiohttp version 3.14.4.

CVE-2026-111748 is a vulnerability in aiohttp prior to version 3.14.4 where an attacker can send an absolute-form HTTP request that manipulates the Request.scheme property. This causes the application to use attacker-controlled scheme data rather than the actual connection protocol, potentially misleading security decisions based on the scheme. The issue is fixed in aiohttp version 3.14.4.

CVE-2026-111066 is a high-severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions from 2.0.0 up to but not including 3.14.4 are affected. The flaw allows unauthenticated attackers to exhaust server file descriptors by sending specially crafted multipart requests to handlers using Request.post(). This uncontrolled resource consumption issue is fixed in version 3.14.4.

CVE-2026-111065 is a vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.4 improperly handle Max-Age processing, which can overflow and prevent connections from closing properly. This can lead to temporary exhaustion of the connection pool until garbage collection reclaims the connections. The issue is fixed in version 3.14.4.

CVE-2026-111064 is a resource allocation vulnerability in aiohttp versions prior to 3.14.4. The flaw involves the absence of keepalive timeout handling during the initial phase of a request, allowing an attacker to keep idle connections open indefinitely without sending request data. This can exhaust server connection capacity. The issue is fixed in aiohttp version 3.14.4.

AIOHTTP versions prior to 3.14.4 do not enforce the Secure attribute on shared cookies, allowing such cookies to be sent over unencrypted requests. This vulnerability is addressed in version 3.14.4.

CVE-2026-34993 is a vulnerability in the AIOHTTP Python asynchronous HTTP framework used by Red Hat Satellite's Lightspeed component. The flaw allows potential arbitrary code execution when untrusted input is loaded via the CookieJar.load() function. Exploitation requires an application to be configured to process attacker-controlled files, which is not typical in default Red Hat deployments. Red Hat has not released a fix yet but provides guidance on mitigating the risk by sanitizing inputs before loading.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

CVE-2026-69244 is a high severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.3 contain an out-of-bounds heap read in the C response parser during error message construction for malformed HTTP responses. This flaw can be triggered by a malicious or accidental server response, potentially causing a denial of service (DoS) in the client. The issue is fixed in version 3.14.3.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.

Multiple security vulnerabilities have been identified and fixed in python-aiohttp, including CRLF injection in multipart headers, resource exhaustion due to unbounded HTTP/1 pipelined request queues, denial of service via incomplete websocket frames, TLS SNI check bypass, and issues causing resource starvation and cookie handling errors. These vulnerabilities can lead to denial of service, resource exhaustion, and security bypasses.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

### Summary Host-only cookies that are saved with ``CookieJar.save()`` and then restored later with ``CookieJar.load()`` lose their host-only status. ### Impact Host-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed. ----- Patch: https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2

### Summary During cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. ### Impact An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). ### Workaround Disable compression if unable to upgrade. ----- Patch: https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

### Summary ``DigestAuthMiddleware`` can send an authentication response after following a cross-origin redirect. ### Impact If the client follows a redirect (the default option) to an attacker controlled domain, the attacker may be able to extract the auth digest. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. ### Workaround Disable ``follow_redirects`` if this is a concern. ----- Patch: https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa

### Summary The `server_hostname` TLS SNI check can be bypassed when an existing connection is reused. ### Impact If an application makes multiple requests to the same domain, but with different per-request `server_hostname` parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. ### Workaround Disable keep_alive if you need to change the `server_hostname` check between requests. ----- Patch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0

### Summary If an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. ### Impact If a web application has WebSocket endpoints, it may be possible for an attacker to execute a DoS attack through excessive memory use. ----- Patch: https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d