CVE-2023-47627: aiohttp - HTTP Header Parsing Vulnerability
Summary
CVE-2023-47627: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affects aiohttp across 2 version ranges.
< 3.8.6
< d5c12ba890557a575c313bb3017910d7616fce3d
Fixed in d5c12ba890557a575c313bb3017910d7616fce3d. How to fix ↓
Also tracked for
- python-aiohttp · Debian:11
The same CVE-2023-47627 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. It provides a convenient way to make HTTP requests and build web applications. The vulnerability in aiohttp lies in its HTTP parser, specifically when AIOHTTP_NO_EXTENSIONS is enabled or when using a prebuilt wheel. This vulnerability can lead to request smuggling, allowing an attacker to manipulate HTTP headers and potentially bypass security measures. The issue has been addressed in version 3.8.6 of aiohttp.
Vulnerability Detail
The HTTP parser in aiohttp has several problems with header parsing, which can be exploited by an attacker to perform request smuggling attacks. Request smuggling occurs when an attacker can manipulate the interpretation of HTTP requests by the server or any intermediate proxies. This can lead to various security issues, such as bypassing security controls, accessing unauthorized resources, or injecting malicious content. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
d5c12ba890557a575c313bb3017910d7616fce3d
This is the first release that contains the fix.
pip install --upgrade "aiohttp==d5c12ba890557a575c313bb3017910d7616fce3d"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The aiohttp package has a vulnerability in its HTTP header parsing, which can be exploited for request smuggling attacks. Users are advised to upgrade to version 3.8.6 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aiohttp →
FAQ
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. It allows developers to make HTTP requests and build web applications using asynchronous programming techniques.
Request smuggling is a technique where an attacker manipulates the interpretation of HTTP requests by the server or any intermediate proxies. This can lead to security vulnerabilities and bypassing of security controls.
The vulnerability in aiohttp's HTTP parser can be exploited by sending specially crafted HTTP headers that can manipulate the interpretation of the request. This can lead to request smuggling attacks and potential security bypasses.
The impact of the aiohttp vulnerability can vary depending on the specific application and its usage of aiohttp. However, potential consequences include bypassing security controls, accessing unauthorized resources, and injecting malicious content.
To fix the aiohttp vulnerability, it is recommended to upgrade to version 3.8.6 or later. This version includes the necessary fixes to address the header parsing issues. Upgrading can be done by updating the package using the package manager or by specifying the updated version in the project's dependencies file.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
