CVE-2021-21330: aiohttp Open Redirect vulnerability
Summary
CVE-2021-21330: aiohttp Open Redirect vulnerability (normalize_path_middleware middleware). Affects aiohttp versions < 3.7.4. Fixed in 3.7.4. How to fix ↓
Also tracked for
- python-aiohttp · Debian:11
The same CVE-2021-21330 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp is a popular Python library for building HTTP-based applications. It provides a powerful framework for handling web requests and responses. The aiohttp.web_middlewares.normalize_path_middleware middleware is a component of aiohttp that normalizes the path of incoming requests. This middleware is responsible for redirecting requests with trailing slashes to the corresponding URL without the trailing slash. However, a bug in this middleware has resulted in an open redirect vulnerability. This means that a maliciously crafted link to an aiohttp-based web server could redirect the user's browser to a different website.
Vulnerability Detail
The open redirect vulnerability in aiohttp allows an attacker to manipulate the URL of a web application and redirect users to a malicious website. This can be exploited by crafting a URL with a specially crafted query parameter that triggers the redirect. The vulnerability is caused by a bug in the normalize_path_middleware middleware. The impact of this vulnerability is that an attacker can trick users into visiting a malicious website, potentially leading to further attacks such as phishing or malware installation.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.7.4
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.7.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of aiohttp is not feasible, a workaround is to avoid using the normalize_path_middleware middleware in your applications. By removing or disabling this middleware, you can prevent the open redirect vulnerability from being exploited. However, this workaround may impact the functionality of your application, as the middleware is responsible for normalizing the path of incoming requests.
Conclusion
The aiohttp open redirect vulnerability is a security flaw that allows an attacker to redirect users from a trusted website to a malicious website. It can be mitigated by upgrading to aiohttp version 3.7.4 or higher or by avoiding the use of the normalize_path_middleware middleware. It is important to take action to fix this vulnerability to protect users from potential phishing attacks and malware installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aiohttp →
FAQ
An open redirect vulnerability is a security flaw that allows an attacker to redirect users from a trusted website to a malicious website. It occurs when a web application does not properly validate or sanitize user-supplied input used in redirect URLs.
The aiohttp open redirect vulnerability can be exploited by crafting a URL with a specially crafted query parameter that triggers the redirect. When a user clicks on the malicious link, their browser will be redirected to the attacker's specified website.
The potential consequences of the aiohttp open redirect vulnerability include phishing attacks, where users are tricked into entering sensitive information on a fake website, and malware installation, where users are unknowingly redirected to a website that downloads and installs malicious software on their devices.
Yes, the aiohttp open redirect vulnerability has been fixed in version 3.7.4. It is recommended to upgrade to this version or higher to mitigate the vulnerability.
Yes, a workaround for the aiohttp open redirect vulnerability is to avoid using the normalize_path_middleware middleware in your applications. By removing or disabling this middleware, you can prevent the open redirect vulnerability from being exploited. However, this workaround may impact the functionality of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
