Skip to content
OpenAdvisories
Low USN-5386-1 1 CVE

python-aiohttp vulnerability

Published Apr 21, 2022 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Jelmer Vernooij and Beast Glatisant discovered that AIOHTTP incorrectly
handled certain URLs, leading to an open redirect attack. A remote
attacker could possibly use this issue to perform phishing attacks.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS python-aiohttp 3.0.1-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS python-aiohttp 3.6.2-1ubuntu0.1~esm1

Vulnerabilities 1

  • Low 3.1
    CVE-2021-21330

    Open redirect vulnerability in aiohttp

    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different websit…

    aio-libs aiohttp aiohttp python-aiohttp Debian Ubuntu Azure Linux PyPI

References

  • report
    https://ubuntu.com/security/CVE-2021-21330