Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aio-libs | aiohttp | < 3.7.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-aiohttp | 3.7.4-1 | — |
| Debian 13 | python-aiohttp | 3.7.4-1 | — |
| Debian 12 | python-aiohttp | 3.7.4-1 | — |
| Debian 10 | python-aiohttp | 3.5.1-1+deb10u1 | DSA-4864-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | python-aiohttp | 3.6.2-1ubuntu0.1~esm1 | USN-5386-1 |
| Ubuntu Pro 18.04 LTS | python-aiohttp | 3.0.1-1ubuntu0.1~esm1 | USN-5386-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | foreman | 2.5.2.17-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-aiohttp | 3.7.4-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-ecdsa +1 | 0.13.3-2.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-pyyaml +1 | 5.4.1-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python-urllib3 +1 | 1.26.5-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | python3-django | 2.2.24-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | satellite +1 | 6.10.0-3.el7sat | RHSA-2021:4702 |
| Red Hat Satellite Capsule 6 | tfm-rubygem-nokogiri | 1.11.3-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | candlepin | 4.0.9-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | foreman | 2.5.2.17-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-aiohttp | 3.7.4-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-ecdsa +1 | 0.13.3-2.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-pyyaml +1 | 5.4.1-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python-urllib3 +1 | 1.26.5-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | python3-django | 2.2.24-1.el7pc | RHSA-2021:4702 |
| Red Hat Satellite 6 | satellite | 6.10.0-3.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-activerecord-session_store | 2.0.0-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-addressable | 2.8.0-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-nokogiri | 1.11.3-2.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-puma | 5.3.2-1.el7sat | RHSA-2021:4702 |
| Red Hat Satellite 6 | tfm-rubygem-rails +1 | 6.0.3.7-1.el7sat | RHSA-2021:4702 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | python-aiohttp | 3.6.0-150100.3.9.1 | SUSE-RU-2022:3275-1 |
| SLES 15 SP4 | python-typing_extensions | 3.10.0.0-150400.3.2.1 | SUSE-RU-2022:3275-1 |
| SLES 15 SP3 | python-aiohttp | 3.6.0-150100.3.9.1 | SUSE-RU-2022:3275-1 |
| SLES 15 SP3 | python-typing_extensions | 3.10.0.0-150100.3.3.1 | SUSE-RU-2022:3275-1 |
| SLES 15 SP2 | python-aiohttp | 3.4.4-3.6.1 | SUSE-SU-2021:1313-1, SUSE-RU-2022:3275-1 |
| SLES 15 SP2 | python-typing_extensions | 3.10.0.0-150100.3.3.1 | SUSE-RU-2022:3275-1 |
| SLES 15 SP1 | python-aiohttp | 3.4.4-3.6.1 | SUSE-SU-2021:1313-1, SUSE-RU-2022:3275-1 |
| SLES 15 SP1 | python-typing_extensions | 3.10.0.0-150100.3.3.1 | SUSE-RU-2022:3275-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-aiohttp | 3.8.5-2.1 | openSUSE-SU-2026:11467-1, openSUSE-SU-2024:13209-1 |
| openSUSE Leap 15.4 | python-aiohttp | 3.6.0-150100.3.9.1 | SUSE-RU-2022:3275-1 |
| openSUSE Leap 15.4 | python-typing_extensions | 3.10.0.0-150400.3.2.1 | SUSE-RU-2022:3275-1 |
| openSUSE Leap 15.3 | python-aiohttp | 3.6.0-150100.3.9.1 | SUSE-RU-2022:3275-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-aiohttp | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | aiohttp | < 3.7.4 | 3.7.4 | GHSA-v6wp-4m6f-gcjg |
Advisories 7
- RHSA-2021:4702 Red Hat Security Advisory: Satellite 6.10 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- openSUSE-SU-2026:11467-1 python313-aiohttp-3.14.3-1.1 on GA media SUSE / openSUSE Security Updates · Aug 7, 2026
- DSA-4864-1 python-aiohttp - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-5386-1 python-aiohttp vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-RU-2022:3275-1 Recommended update for python-aiohttp, python-typing_extensions SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13209-1 python310-aiohttp-3.8.5-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1313-1 Security update for python-aiohttp SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg
- https://github.com/aio-libs/aiohttp/commit/2545222a3853e31ace15d87ae0e2effb7da0c96b
- https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst#374-2021-02-25
- https://pypi.org/project/aiohttp/
- DSA-4864 vendor-advisory
- FEDORA-2021-673b10ed77 vendor-advisory
- FEDORA-2021-902c1b07c9 vendor-advisory
- GLSA-202208-19 vendor-advisory