---
id: CVE-2023-49081
title: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
summary: >-
  aiohttp is an asynchronous HTTP client/server framework for asyncio and
  Python. Improper validation made it possible for an attacker to modify the
  HTTP request (e.g. to insert a new header) or create a new HTTP request if the
  attacker co…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-20
vendor: aiohttp
product: aiohttp
affected:
  - aiohttp < 3.9.0
patched:
  - aiohttp 3.9.0
published: '2023-11-30'
updated: '2026-06-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-49081'
references:
  - url: 'https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e'
    label: security-advisories@github.com
  - url: >-
      https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b
    label: security-advisories@github.com
  - url: 'https://github.com/aio-libs/aiohttp/pull/7835/files'
    label: security-advisories@github.com
  - url: >-
      https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2
    label: security-advisories@github.com
  - url: 'https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/aio-libs/aiohttp/pull/7835/files'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-49081'
  - url: 'https://github.com/aio-libs/aiohttp'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-250.yaml
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY5SI6NK5243DEEDQUFKQKW5GQNKQUMA
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A
tags:
  - nvd
  - osv
  - pip
epss: 0.00882
epssPercentile: 0.57436
ingestedAt: '2026-06-29T13:24:33.944Z'
aliases:
  - GHSA-q3qx-c6g2-7pw2
  - PYSEC-2023-250
ecosystem: pip
---

## Overview

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

## Affected

- `aiohttp < 3.9.0`

## Remediation

Upgrade past the affected range:

- `aiohttp 3.9.0`

## Package advisory (CVE-2023-49081)

Affected packages:

- `aiohttp < 3.9.0`

Patched in:

- `aiohttp 3.9.0`

Source: https://osv.dev/vulnerability/GHSA-q3qx-c6g2-7pw2