8 results · Clear filters · Feed
-
Low 2.7
AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.
-
Low 2.7
AIOHTTP: HTTP response splitting via \r in reason phrase
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patche…
-
Low 2.7
AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue…
-
Low 2.7
AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.
-
Low 2.7
AIOHTTP: CRLF injection in multipart part content type header construction
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in …
-
Low 2.7
AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.
-
Low 2.7
AIOHTTP Vulnerable to Cookie Parser Warning Storm
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to…
-
Low 2.7
AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there…