AIOHTTP vulnerabilities

Multiple cases were found in aiohttp where excessive or unbounded memory use, or excessive CPU consumption, can be triggered by attacker-controlled requests. An attacker could cause resource exhaustion through specially crafted requests.

In aiohttp before 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can smuggle requests when an application runs without a standard wheel (e.g., with AIOHTTP_NO_EXTENSIONS) and an intermediary interprets the framing differently.

In AIOHTTP prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user accessing an untrusted subdomain may have host-only protections stripped from cookies.

In aiohttp before 3.14.4, an attacker can send an absolute-form request causing Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications using Request.scheme for security decisions can be tricked about whether the connection is encrypted.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

In aiohttp before 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can temporarily exhaust the connection pool until garbage collection resolves the connections.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

In aiohttp before 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can cause a shared cookie marked Secure to be sent with an unencrypted request.

AIOHTTP, an asynchronous HTTP client/server framework for Python, prior to version 3.14.3, has an out-of-bounds heap read vulnerability in the C response parser. While building an error message for a malformed response, an out-of-bounds read can occur, leading to DoS in the client. Fixed in version 3.14.3.

AIOHTTP prior to version 3.14.2 contains a request smuggling vulnerability related to WebSocket upgrades. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data.

AIOHTTP before 3.14.2 in the WebSocket client accepts and decompresses frames with the RSV1 bit set even without negotiating the permessage-deflate extension. A malicious server can cause unexpected CPU and memory consumption.

In the AIOHTTP library before version 3.14.1, a vulnerability allows bypassing the max_line_size check in HTTP requests when using the optimized C parser. An attacker can send oversized lines, causing excessive memory consumption and potentially leading to a DoS attack.

In AIOHTTP before version 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. The attack requires an open redirect vulnerability on the target domain, and the attacker only receives the digest, allowing credential extraction only if cryptography is weak or passwords are reused.

In AIOHTTP prior to version 3.14.0, cookies set via the `cookies` parameter are sent after a cross-origin redirect. If a developer uses the `cookies` parameter per-request, sensitive data might leak to an attacker controlling the redirect.

AIOHTTP, an asynchronous HTTP framework for Python, prior to version 3.14.0 has a vulnerability in the CookieJar.load() function that allows arbitrary code execution when using untrusted input. Most applications use this function with their own data, so the risk is low, but if attacker-controlled files are loaded, remote code execution may occur.

AIOHTTP (asyncio/Python) prior to version 3.13.4 allowed multiple Host headers in requests. The issue has been patched in version 3.13.4.

AIOHTTP prior to version 3.13.4 allows an attacker who controls the reason parameter when creating a Response to inject extra headers or perform similar exploits. The issue has been patched in version 3.13.4.

AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, prior to 3.13.4 drops the Authorization header when following redirects to a different origin but retains Cookie and Proxy-Authorization headers. This may leak credentials to another origin. The issue is patched in 3.13.4.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.

In aiohttp prior to version 3.13.4, an attacker who controls the content_type parameter could inject extra headers or perform similar exploits. The issue has been patched in version 3.13.4.

AIOHTTP versions 3.13.2 and below have a vulnerability where reading multiple invalid cookies can cause a logging storm. An attacker can craft a Cookie header to trigger excessive warning logs if the cookies attribute is accessed.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.

AIOHTTP, an asynchronous HTTP framework for asyncio and Python, versions 3.13.2 and below allow a crafted request to cause uncontrolled memory consumption on the server. If an application uses the Request.post() method in a handler, an attacker may freeze the server by exhausting memory. This issue is fixed in version 3.13.3.

AIOHTTP versions 3.13.2 and below contain a vulnerability that allows an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1) and the application includes a handler using Request.post(), an attacker may execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production), an attacker may ascertain the existence of path components. This is fixed in version 3.13.3.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.

A vulnerability in AIOHTTP versions 3.13.2 and below allows a zip bomb attack that, upon decompression, can exhaust host memory and cause a DoS.

The vulnerability in aiohttp allows an attacker to modify an HTTP request or create a new one if they control the HTTP version. This issue only occurs if the attacker can control the HTTP version of the request.

The vulnerability in aiohttp allows an attacker to modify the HTTP request through improper validation, potentially leading to header injection or the creation of new requests if the attacker controls the HTTP method.

A vulnerability in aiohttp (up to version 3.8.4) allows HTTP request smuggling attacks due to misinterpretation of HTTP header values. This affects users running aiohttp as an HTTP server.