Description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aio-libs | aiohttp | < 3.9.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-aiohttp | 3.9.5-1 | — |
| Debian 13 | python-aiohttp | 3.9.5-1 | — |
| Debian 12 | python-aiohttp | 3.8.4-1+deb12u1 | DSA-5828-1 |
| Debian 11 | python-aiohttp | 3.7.4-1+deb11u1 | DLA-4041-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-aiohttp | No fix yet | — |
| Ubuntu 25.10 | python-aiohttp | No fix yet | — |
| Ubuntu 24.04 LTS | python-aiohttp | 3.9.1-1ubuntu0.1 | USN-6991-1 |
| Ubuntu 22.04 LTS | python-aiohttp | 3.8.1-4ubuntu0.2 | USN-6991-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | python-aiohttp | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-aiohttp | 3.6.2-1ubuntu1+esm3 | USN-6991-1 |
| Ubuntu Pro 18.04 LTS | python-aiohttp | 3.0.1-1ubuntu0.1~esm4 | USN-6991-1 |
| Ubuntu Pro 16.04 LTS | python-aiohttp | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.9.1.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.9.1.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | puppetserver | 7.14.0-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-aiohttp +1 | 3.9.2-0.1.el8pc | RHSA-2024:2010, RHSA-2024:1536 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.22-1.el8pc | RHSA-2024:2010, RHSA-2024:1536 |
| Red Hat Satellite Capsule 6 | python-galaxy-importer +1 | 0.4.18-2.el8pc | RHSA-2024:2010, RHSA-2024:1536 |
| Red Hat Satellite Capsule 6 | python-jinja2 +1 | 3.1.3-0.1.el8pc | RHSA-2024:2010, RHSA-2024:1536 |
| Red Hat Satellite Capsule 6 | python-pycryptodomex +1 | 3.20.0-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-pygments +1 | 2.17.0-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python3.11-aiohttp | 3.9.2-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python3.11-django | 4.2.9-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python3.11-galaxy-importer | 0.4.19-2.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python3.11-jinja2 | 3.1.3-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | rubygem-activesupport | 6.1.7.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | foreman +14 | 3.9.1.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | puppetserver | 7.14.0-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-aiohttp +1 | 3.9.2-0.1.el8pc | RHSA-2024:2010, RHSA-2024:1536 |
| Red Hat Satellite 6 | python-django +1 | 3.2.22-1.el8pc | RHSA-2024:2010, RHSA-2024:1536 |
| Red Hat Satellite 6 | python-galaxy-importer +1 | 0.4.18-2.el8pc | RHSA-2024:2010, RHSA-2024:1536 |
| Red Hat Satellite 6 | python-jinja2 +1 | 3.1.3-0.1.el8pc | RHSA-2024:2010, RHSA-2024:1536 |
| Red Hat Satellite 6 | python-pycryptodomex +1 | 3.20.0-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-pygments +1 | 2.17.0-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python3.11-aiohttp | 3.9.2-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python3.11-django | 4.2.9-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python3.11-galaxy-importer | 0.4.19-2.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python3.11-jinja2 | 3.1.3-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | rubygem-activesupport | 6.1.7.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | rubygem-audited | 5.4.2-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | rubygem-puma | 6.4.2-1.el8sat | RHSA-2024:2010 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhui 4 | python-aiohttp +1 | 3.9.2-1.el8ui | RHSA-2024:1878 |
| Red Hat Rhui 4 | python-cryptography +1 | 41.0.6-1.el8ui | RHSA-2024:1878 |
| Red Hat Rhui 4 | python-django +1 | 4.2.11-1.el8ui | RHSA-2024:1878 |
| Red Hat Rhui 4 | python-ecdsa +1 | 0.18.0-4.el8ui | RHSA-2024:1878 |
| Red Hat Rhui 4 | python-jinja2 +1 | 3.1.3-1.el8ui | RHSA-2024:1878 |
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.4.5-1.el8ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.4.5-1.el8ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.5.5-2.el8ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2 | python-aiohttp +1 | 3.9.3-1.el9ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2 | python-django +1 | 4.2.11-1.el9ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2 | python39-aiohttp +1 | 3.9.3-1.el8ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2 | python39-django +1 | 4.2.11-1.el8ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.4.5-1.el8ap | RHSA-2024:1640 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | python-aiohttp | 3.9.3-150400.10.14.1 | SUSE-SU-2024:0577-1 |
| SLES 3 | python-aiohttp | 3.9.3-150400.10.14.1 | SUSE-SU-2024:0577-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | python-aiohttp | 3.9.3-150400.10.14.1 | SUSE-SU-2024:0577-1 |
| SLE HPC 15 SP4 | python-aiohttp | 3.9.3-150400.10.14.1 | SUSE-SU-2024:0577-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-aiohttp | 3.9.3-1.1 | openSUSE-SU-2026:11467-1, openSUSE-SU-2024:13642-1 |
| openSUSE Leap 15.5 | python-aiohttp | 3.9.3-150400.10.14.1 | SUSE-SU-2024:0577-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-aiohttp | 3.9.3-r0 | — |
| Alpine v3.23 | py3-aiohttp | 3.9.3-r0 | — |
| Alpine v3.22 | py3-aiohttp | 3.9.3-r0 | — |
| Alpine v3.21 | py3-aiohttp | 3.9.3-r0 | — |
| Alpine v3.20 | py3-aiohttp | 3.9.3-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-aiohttp | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | python-aiohttp | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | checkov | 3.0.34-r1 | — |
| Wolfi rolling | py3-aiohttp | 3.9.3-r0 | — |
| Wolfi rolling | py3-cassandra-medusa +1 | 0.17.2-r1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- aiohttp 3.9.1 - directory traversal PoC EDB-52474 · webapps · Feb 4, 2026
GitHub 15 repositories · most starred shown
-
jhonnybonny/CVE-2024-23334 ★ 27 · Mar 19, 2024
aiohttp LFI (CVE-2024-23334)
-
z3rObyte/CVE-2024-23334-PoC ★ 20 · Mar 18, 2024
A proof of concept of the path traversal vulnerability in the python AioHTTP library =< 3.9.1
-
ox1111/CVE-2024-23334 ★ 6 · Feb 28, 2024
CVE-2024-23334
-
wizarddos/CVE-2024-23334 ★ 5 · Oct 20, 2024
Proof-of-Concept for LFI/Path Traversal vulnerability in Aiohttp =< 3.9.1
-
s4botai/CVE-2024-23334-PoC ★ 4 · Sep 8, 2024
A proof of concept of the LFI vulnerability on aiohttp 3.9.1
-
sxyrxyy/aiohttp-exploit-CVE-2024-23334-certstream ★ 4 · Mar 17, 2024
-
TheRedP4nther/LFI-aiohttp-CVE-2024-23334-PoC ★ 2 · Nov 14, 2024
Bash script to automate Local File Inclusion (LFI) attacks on aiohttp server version 3.9.1.
-
Betan423/CVE-2024-23334-PoC ★ 1 · Dec 9, 2024
This repository is a proof of concept (POC) for CVE-2024-23334, demonstrating an attempt to replicate the bug in aiohttp that leads to Local File Inclusion (LFI).
-
Arc4he/CVE-2024-23334-PoC ★ 1 · Nov 9, 2024
Proof of concept of the parh traversal in python AioHTTP library =< 3.9.1
-
frogb1t/CVE-2024-23334 ★ 1 · Nov 7, 2024
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- aiohttp - Directory Traversal http/cves/2024/CVE-2024-23334.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | aiohttp | >= 1.0.5, < 3.9.2 | 3.9.2 | GHSA-5h86-8mv2-jq9f |
Advisories 11
- RHSA-2024:1640 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:2010 Red Hat Security Advisory: Satellite 6.15.0 release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2024:1878 Red Hat Security Advisory: RHUI 4.8 Release - Security Updates, Bug Fixes, and Enhancements Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2024:1536 Red Hat Security Advisory: Satellite 6.14.3 Async Security Update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- openSUSE-SU-2026:11467-1 python313-aiohttp-3.14.3-1.1 on GA media SUSE / openSUSE Security Updates · Aug 7, 2026
- USN-6991-1 python-aiohttp vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5828-1 python-aiohttp - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4041-1 python-aiohttp - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2024:0577-1 Security update for python-aiohttp, python-time-machine SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13642-1 python310-aiohttp-3.9.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0949 Red Hat Satellite: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 26, 2026
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f
- https://github.com/aio-libs/aiohttp/pull/8079
- https://github.com/aio-libs/aiohttp/commit/1c335944d6a8b1298baf179b7c0b3069f10c514b
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD/