CVE-2023-47641: aiohttp Inconsistent Interpretation of HTTP Protocol
Summary
CVE-2023-47641: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affects aiohttp across 2 version ranges.
< 3.8.0
< f016f0680e4ace6742b03a70cb0382ce86abe371
Fixed in f016f0680e4ace6742b03a70cb0382ce86abe371. How to fix ↓
Also tracked for
- python-aiohttp · Debian:11
The same CVE-2023-47641 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. It allows developers to build web applications and APIs using the asyncio library. aiohttp supports HTTP/1.1, which is a persistent protocol that enables multiple requests and responses to be sent over a single connection. This vulnerability affects certain versions of aiohttp and involves the inconsistent interpretation of the HTTP protocol.
Vulnerability Detail
The vulnerability arises when both the Content-Length (CL) and Transfer-Encoding (TE) headers are present in an HTTP request. In such cases, aiohttp may incorrectly interpret the request, leading to the parsing of two entities. This can be exploited by an attacker in various ways. For example, if a reverse proxy (frontend) accepts both CL and TE headers and aiohttp is used as the backend, an attacker can pass a malicious TE header value such as 'chunked123'. The frontend entity will ignore this header and parse the Content-Length, allowing the attacker to bypass proxy rules and potentially poison other sockets. This can be used to pass authentication headers or perform open redirects, redirecting unsuspecting users to malicious websites and logging their requests.
How To Fix
Latest published version: 3.14.5 as of 22 Oct 2026
pip install --upgrade "aiohttp==3.14.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
f016f0680e4ace6742b03a70cb0382ce86abe371
This is the first release that contains the fix.
pip install --upgrade "aiohttp==f016f0680e4ace6742b03a70cb0382ce86abe371"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The aiohttp package is susceptible to a vulnerability that allows for the inconsistent interpretation of the HTTP protocol. This can be exploited to bypass proxy rules, poison sockets, and perform open redirects. The aiohttp development team has addressed this issue in release 3.8.0, and users are advised to upgrade to this version or a later one. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for aiohttp →
FAQ
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. It allows developers to build web applications and APIs using the asyncio library.
The vulnerability affects aiohttp versions prior to 3.8.0.
An attacker can exploit this vulnerability by sending an HTTP request with both Content-Length and Transfer-Encoding headers. By manipulating the headers, they can bypass proxy rules, poison sockets, and potentially perform open redirects.
The impact of this vulnerability includes the ability to bypass proxy rules, poison sockets, pass authentication headers, and perform open redirects. It can lead to unauthorized access, data leakage, and potential compromise of user interactions.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to aiohttp version 3.8.0 or higher.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp.
