aiohttp versions prior to 3.10.11 have a vulnerability in the Python chunk extension parser that incorrectly handles newlines, leading to potential HTTP request smuggling attacks. This issue affects installations using the pure Python version or when C extensions are disabled via AIOHTTP_NO_EXTENSIONS. A fix is available in version 3.10.11.