{"id":"GHSA-pjjw-qhg8-p2p9","title":"aiohttp has vulnerable dependency that is vulnerable to request smuggling","summary":"aiohttp has vulnerable dependency that is vulnerable to request smuggling","severity":"medium","vendor":"aiohttp","product":"aiohttp","ecosystem":"pip","affected":["aiohttp < 3.8.6"],"patched":["aiohttp 3.8.6"],"published":"2023-11-27","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:04.355249499Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-pjjw-qhg8-p2p9","references":[{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pjjw-qhg8-p2p9"},{"url":"https://github.com/aio-libs/aiohttp/commit/996de2629ef6b4c2934a7c04dfd49d0950d4c43b"},{"url":"https://github.com/aio-libs/aiohttp/commit/bcc416e533796d04fb8124ef1e7686b1f338767a"},{"url":"https://github.com/aio-libs/aiohttp"}],"tags":["osv","pip"],"ingestedAt":"2026-09-12T03:13:01.716Z","slug":"GHSA-pjjw-qhg8-p2p9","body":"## Overview\n\n### Summary\nllhttp 8.1.1 is vulnerable to two request smuggling vulnerabilities.\nDetails have not been disclosed yet, so refer to llhttp for future information.\nThe issue is resolved by using llhttp 9+ (which is included in aiohttp 3.8.6+).\n\n## Affected packages\n\n- `aiohttp < 3.8.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aiohttp 3.8.6`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}