CVE-2021-21330: Open Redirect Vulnerability in aiohttp
Summary
CVE-2021-21330: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affects aiohttp across 2 version ranges.
< 3.7.4
< 2545222a3853e31ace15d87ae0e2effb7da0c96b
Fixed in 2545222a3853e31ace15d87ae0e2effb7da0c96b. How to fix ↓
Also tracked for
- python-aiohttp · Debian:11
The same CVE-2021-21330 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. It provides a powerful and flexible foundation for building web applications. However, versions prior to 3.7.4 are vulnerable to an open redirect vulnerability.
Vulnerability Detail
The open redirect vulnerability in aiohttp allows an attacker to craft a malicious link that can redirect the user's browser to a different website. This vulnerability is caused by a bug in the aiohttp.web_middlewares.normalize_path_middleware middleware. By exploiting this vulnerability, an attacker can trick users into visiting a malicious website, potentially leading to further attacks or unauthorized access to sensitive information.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2545222a3853e31ace15d87ae0e2effb7da0c96b
This is the first release that contains the fix.
pip install --upgrade "aiohttp==2545222a3853e31ace15d87ae0e2effb7da0c96b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the aiohttp dependency is not possible, a workaround is to avoid using the aiohttp.web_middlewares.normalize_path_middleware middleware in your applications. By removing or disabling this middleware, the open redirect vulnerability can be mitigated. However, it is still strongly recommended to upgrade to the latest version of aiohttp to ensure comprehensive security.
Conclusion
The open redirect vulnerability in aiohttp can be fixed by upgrading to version 3.7.4 or higher. If upgrading is not feasible, removing or disabling the aiohttp.web_middlewares.normalize_path_middleware middleware can serve as a temporary workaround. It is crucial to address this vulnerability to prevent potential security breaches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aiohttp →
FAQ
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. It provides a powerful and flexible foundation for building web applications.
An open redirect vulnerability is a security flaw that allows an attacker to craft a URL that redirects the user's browser to a different website. This can be exploited to trick users into visiting malicious websites or phishing pages.
To fix the open redirect vulnerability, it is recommended to upgrade the aiohttp dependency to version 3.7.4 or higher. Alternatively, you can remove or disable the aiohttp.web_middlewares.normalize_path_middleware middleware in your applications.
No, only versions prior to 3.7.4 are affected by this open redirect vulnerability. It has been fixed in version 3.7.4, so upgrading to this version or higher is recommended.
There are no known public exploits of this vulnerability at the time of writing. However, it is important to patch the vulnerability as soon as possible to prevent potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
