CVE-2024-23829Medium· 6.5▾ Sunlitaiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.0%
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input. Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.
aiohttp < 3.9.2fedora = 39Upgrade past the affected range:
aiohttp 3.9.2Connected by shared product, vendor, weakness, or advisory.
CVE-2023-37276Medium· 5.3aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2023-47627Medium· 5.3AIOHTTP has problems in HTTP parser (the python one, not llhttp)
CVE-2024-23334Medium· 5.9aiohttp is vulnerable to directory traversal
CVE-2024-52304Mediumaiohttp allows request smuggling due to incorrect parsing of chunk extensions
CVE-2024-27306Medium· 6.1aiohttp Cross-site Scripting vulnerability on index pages for static file handling
CVE-2024-30251High· 7.5aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests