CVE-2023-47641: Inconsistent Interpretation of Content-Length vs. Transfer-Encoding in aiohttp
Summary
CVE-2023-47641: Impact Aiohttp has a security vulnerability regarding the inconsistent interpretation of the http protocol. Affects aiohttp versions < 3.8.0. Fixed in 3.8.0. How to fix ↓
Also tracked for
- python-aiohttp · Debian:11
The same CVE-2023-47641 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp is a Python library for making HTTP requests. It provides an asynchronous framework for building web applications and handling HTTP requests and responses. The library is widely used in Python projects for its simplicity and performance. However, aiohttp is vulnerable to an inconsistency in the interpretation of the HTTP protocol, specifically related to the Content-Length and Transfer-Encoding headers.
Vulnerability Detail
The vulnerability in aiohttp arises from the inconsistent interpretation of the Content-Length and Transfer-Encoding headers. In HTTP/1.1, which is a persistent protocol, if both headers are present, it can lead to incorrect interpretation by entities parsing the HTTP. This inconsistency can be exploited to poison other sockets and bypass proxy rules. An attacker can potentially pass Authentication Headers and perform Open Redirect attacks by combining this vulnerability with other weaknesses. The impact of this vulnerability can be significant, compromising the security and integrity of the affected system.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.8.0
This is the first release that contains the fix.
pip install --upgrade "aiohttp==3.8.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating aiohttp is not immediately feasible, a possible workaround is to configure a reverse proxy (frontend) that accepts both Content-Length and Transfer-Encoding headers, while using aiohttp as the backend. By passing a non-standard Transfer-Encoding value, such as 'chunked123', the frontend entity will ignore this header and parse the Content-Length correctly. This workaround should be implemented with caution and thoroughly tested to ensure it does not introduce any other vulnerabilities or issues.
Conclusion
The vulnerability in aiohttp regarding the inconsistent interpretation of Content-Length and Transfer-Encoding headers can have serious consequences for the security and integrity of affected systems. It is crucial to update aiohttp to the latest version or implement the recommended workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aiohttp →
FAQ
aiohttp is a Python library for making HTTP requests and building web applications.
The impact of this vulnerability is the potential bypassing of proxy rules, poisoning of sockets, and the ability to pass Authentication Headers or perform Open Redirect attacks.
To fix this vulnerability, update aiohttp to version 3.8.0 or later.
A possible workaround is to configure a reverse proxy that accepts both Content-Length and Transfer-Encoding headers.
Yes, a Proof-of-Concept can be created by setting up a reverse proxy and using aiohttp as the backend.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
