CVE-2024-52304: aiohttp Request Smuggling Vulnerability Due to Incorrect Chunk Extension Parsing
Summary
CVE-2024-52304: aiohttp allows request smuggling due to incorrect parsing of chunk extensions. Affects aiohttp versions < 3.10.11. Fixed in 3.10.11. How to fix ↓
Also tracked for
- python-aiohttp · Debian:11
The same CVE-2024-52304 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp is a popular asynchronous HTTP client/server framework for Python, designed to handle asynchronous requests efficiently. It is widely used in web applications for its non-blocking capabilities and ease of use. However, it has been identified that certain configurations of aiohttp, particularly when using the pure Python version without C extensions, can lead to security vulnerabilities, specifically request smuggling attacks.
Vulnerability Detail
The vulnerability arises from the incorrect parsing of newlines in chunk extensions by the Python parser within aiohttp. This flaw can potentially allow an attacker to perform request smuggling, which may enable them to bypass firewalls or proxy protections. The issue is particularly relevant when the aiohttp package is installed without C extensions or when the AIOHTTP_NO_EXTENSIONS environment variable is enabled. This can lead to unauthorized access or manipulation of requests, posing a significant security risk.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.10.11
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.10.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating is not immediately possible, consider disabling the use of the pure Python version of aiohttp by ensuring that the C extensions are installed and used. Additionally, avoid setting the AIOHTTP_NO_EXTENSIONS environment variable to prevent the vulnerability from being exploited.
Conclusion
In summary, the aiohttp package has a vulnerability (CVE-2024-52304) that allows for request smuggling due to incorrect parsing of chunk extensions. It is crucial for users to update to the patched version (3.10.11 or later) to protect their applications from potential attacks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for aiohttp →
FAQ
Request smuggling is a technique used by attackers to send multiple HTTP requests in a single request, which can lead to unauthorized actions or data exposure.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any installation.
If left unaddressed, this vulnerability can allow attackers to bypass security measures, potentially leading to data breaches or unauthorized access to sensitive information.
Yes, updating to aiohttp version 3.10.11 or later will mitigate the vulnerability and is recommended for all users.
Yes, Vulert can monitor your dependencies in real-time for open-source vulnerabilities using just your Pipfile.lock, making it easy to stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
