CVE-2021-21330Low· 3.1▾ Sunlit`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)
▾ Sunlit zone — Low / medium · no exploitation signal
impact 17.1 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.9%
Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.
It is caused by a bug in the aiohttp.web_middlewares.normalize_path_middleware middleware.
This security problem has been fixed in v3.7.4. Upgrade your dependency as follows:
pip install aiohttp >= 3.7.4
If upgrading is not an option for you, a workaround can be to avoid using aiohttp.web_middlewares.normalize_path_middleware in your applications.
If you have any questions or comments about this advisory:
Credit: Jelmer Vernooij and Beast Glatisant.
aiohttp < 3.7.4Upgrade to a patched release:
aiohttp 3.7.4Connected by shared product, vendor, weakness, or advisory.
GHSA-pjjw-qhg8-p2p9Mediumaiohttp has vulnerable dependency that is vulnerable to request smuggling
CVE-2023-47627Medium· 5.3AIOHTTP has problems in HTTP parser (the python one, not llhttp)
CVE-2024-23334Medium· 5.9aiohttp is vulnerable to directory traversal
CVE-2026-59881MediumAIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
CVE-2026-22815Mediumaiohttp allows unlimited trailer headers, leading to possible uncapped memory usage
CVE-2026-34515MediumAIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows