VulertSecurity VulertSecurity

Vulnerability Database · PyPI · aiohttp · Version

aiohttp 3.10.0b1

3.10.0b1 is affected by 83 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 3.14.5.

Critical 0 High 19 Medium 36 Low 23 Unrated 5

All aiohttp versions & vulnerabilities → Source repository Search the database for this package →
Released 22 Jul 2024 Licence Apache-2.0 Also known from other sources 78 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

aiohttp 3.10.0b1 vulnerabilities

83 vulnerabilities cover aiohttp 3.10.0b1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Excessive Resource Consumption in aiohttp: A Critical Vulnerability 8.7 high 3.14.4 19 Oct 2026
CVE-2026-111066: AIOHTTP File Descriptor Exhaustion in Multipart Requests 8.2 high 3.14.4 20 Oct 2026
CVE-2026-111064: aiohttp Server Lacks Initial Request/Header Timeout 8.2 high 3.14.4 19 Oct 2026
CVE-2025-69223: AIOHTTP Zip Bomb Vulnerability Leading to DoS Attack 7.5 high 3.13.3 07 Jul 2026
CVE-2026-54275: AIOHTTP Server Hostname TLS SNI Check Bypass Vulnerability 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54277: AIOHTTP Memory Exhaustion Vulnerability Due to Oversized HTTP Lines 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54278: AIOHTTP Compression Handling Vulnerability Leading to Potential DoS 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54279: AIOHTTP CookieJar Host-Only Status Loss Vulnerability 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54280: AIOHTTP Resource Starvation Vulnerability 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54273: AIOHTTP Memory Exhaustion Vulnerability Due to Unbounded Pipelined Requests 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54274: AIOHTTP WebSocket Frame Size Limit Bypass Vulnerability 7.5 high 3.14.1 22 Jun 2026
CVE-2026-50269: AIOHTTP Multipart Header Injection Vulnerability 7.5 high 3.14.0 22 Jun 2026
CVE-2026-47265: AIOHTTP Cookie Handling Vulnerability Leading to Potential Data Leakage 7.5 high 3.14.0 02 Jun 2026
CVE-2026-34513: AIOHTTP Unbounded DNS Cache Leading to Potential DoS 7.5 high 3.13.4 01 Apr 2026
CVE-2026-34515: AIOHTTP Static Resource Handler Information Exposure Vulnerability 7.5 high 3.13.4 01 Apr 2026
CVE-2025-69223: AIOHTTP Zip Bomb Vulnerability Leading to DoS Attacks 7.5 high 3.13.3 05 Jan 2026
CVE-2026-34993: AIOHTTP Arbitrary Code Execution via CookieJar.load() 7.3 high 3.14.0 02 Jun 2026
CVE-2026-69244: AIOHTTP Out-of-Bounds Heap Read Vulnerability in C HTTP Response Parser 7.1 high 3.14.3 04 Aug 2026
CVE-2026-69244: AIOHTTP Out-of-Bounds Heap Read Vulnerability in C HTTP Response Parser 7.1 high 3.14.3 03 Aug 2026
CVE-2026-111065: AIOHTTP Connector Pool Exhaustion via Max-Age Overflow 6.9 medium 3.14.4 20 Oct 2026
CVE-2026-59881: AIOHTTP WebSocket Client Accepts Compressed Frames Without Negotiated Permessage-Deflate 6.9 medium 3.14.2 04 Aug 2026
CVE-2026-59881: AIOHTTP WebSocket Client Accepts Unnegotiated Compressed Frames 6.9 medium 3.14.2 03 Aug 2026
CVE-2026-22815: aiohttp Unrestricted Trailer Headers Leading to Memory Exhaustion 6.9 medium 3.13.4 01 Apr 2026
CVE-2025-69229: AIOHTTP DoS Vulnerability through Chunked Messages 6.6 medium 3.13.3 07 Jul 2026
CVE-2025-69228: AIOHTTP Denial of Service Vulnerability through Large Payloads 6.6 medium 3.13.3 07 Jul 2026
CVE-2025-69227: AIOHTTP DoS Vulnerability Due to Assert Bypass 6.6 medium 3.13.3 07 Jul 2026
CVE-2026-54274: aiohttp Incomplete WebSocket Frame Payloads Bypass Memory Limits 6.6 medium 3.14.1 15 Jun 2026
CVE-2026-54273: aiohttp HTTP/1 Pipelined Requests Queue Without Limit 6.6 medium 3.14.1 15 Jun 2026
CVE-2026-54278: aiohttp Unread Compressed Request Bodies Bypass client_max_size During Cleanup 6.6 medium 3.14.1 15 Jun 2026
CVE-2026-54277: aiohttp Package C HTTP Parser Bypass Vulnerability 6.6 medium 3.14.1 15 Jun 2026
CVE-2026-47265: AIOHTTP Cross-Origin Redirect Vulnerability with Per-Request Cookies 6.6 medium 3.14.0 03 Jun 2026
CVE-2026-34516: AIOHTTP Multipart Header Size Bypass Vulnerability 6.6 medium 3.13.4 01 Apr 2026
CVE-2026-34515: AIOHTTP Static Resource Handler Vulnerability on Windows 6.6 medium 3.13.4 01 Apr 2026
Denial of Service Vulnerability in AIOHTTP: Excessive CPU Blocking through Chunked Messages 6.6 medium 3.13.3 05 Jan 2026
Denial of Service Vulnerability in AIOHTTP: Memory Exhaustion via Large Payloads 6.6 medium 3.13.3 05 Jan 2026
CVE-2025-69227: AIOHTTP Denial of Service Vulnerability Due to Assert Bypass 6.6 medium 3.13.3 05 Jan 2026
CVE-2024-23829: aiohttp - Incomplete Fix for HTTP Parser Vulnerability 6.5 medium 33ccdfb0a12690af5bb49bda2319ec0907fa7827 29 Jan 2024
CVE-2026-34993: AIOHTTP Vulnerable to Deserialization of Untrusted Data 6.4 medium 3.14.0 03 Jun 2026
CVE-2026-111748: AIOHTTP Absolute-Form Request Target Spoofing Vulnerability 6.3 medium 3.14.4 20 Oct 2026
CVE-2026-111750: AIOHTTP Pure-Python Parser Request Smuggling Vulnerability 6.3 medium 3.14.4 20 Oct 2026
CVE-2026-69243: AIOHTTP HTTP Request Smuggling via WebSocket Upgrade 6.3 medium 3.14.2 04 Aug 2026
CVE-2026-69243: AIOHTTP HTTP Request Smuggling via WebSocket Upgrade 6.3 medium 3.14.2 03 Aug 2026
CVE-2026-54276: aiohttp DigestAuthMiddleware Exposes Credentials to Cross-Origin Redirects 6.3 medium 3.14.1 15 Jun 2026
CVE-2026-34525: AIOHTTP Duplicate Host Header Vulnerability 6.3 medium 3.13.4 01 Apr 2026
CVE-2026-54276: AIOHTTP DigestAuthMiddleware Cross-Origin Redirect Vulnerability 6.1 medium 3.14.1 22 Jun 2026
CVE-2022-33124: Denial of Service in aiohttp 5.5 medium No fix published 24 Jun 2022
CVE-2022-33124: AIOHTTP 3.8.1 Denial of Service Vulnerability 5.5 medium No fix published 23 Jun 2022
CVE-2026-34525: aiohttp Multiple Host Header Vulnerability 5.3 medium 3.13.4 01 Apr 2026
CVE-2026-34519: AIOHTTP Response Header Injection Vulnerability 5.3 medium 3.13.4 01 Apr 2026
CVE-2026-34518: AIOHTTP Authorization Header Vulnerability in Redirects 5.3 medium 3.13.4 01 Apr 2026
CVE-2026-34514: AIOHTTP Content-Type Parameter Vulnerability Leading to Header Injection 5.3 medium 3.13.4 01 Apr 2026
CVE-2026-34517: AIOHTTP Memory Handling Vulnerability in Multipart Form Fields 5.3 medium 3.13.4 01 Apr 2026
CVE-2024-42367: aiohttp Path Traversal Vulnerability in Compressed Files as Symlinks 4.8 medium 3.10.2 07 Jul 2026
Path Traversal Vulnerability in aiohttp 4.8 medium 3.10.2 09 Aug 2024
CVE-2025-69230: AIOHTTP Cookie Parser Warning Storm Vulnerability 2.7 low 3.13.3 07 Jul 2026
CVE-2025-69226: AIOHTTP Brute-Force Leak of Internal Static File Path Components 2.7 low 3.13.3 07 Jul 2026
CVE-2025-69224: AIOHTTP Request Smuggling Vulnerability Due to Unicode Processing 2.7 low 3.13.3 07 Jul 2026
CVE-2025-69225: AIOHTTP - Potential Request Smuggling Vulnerability Due to Unicode Match Groups 2.7 low 3.13.3 07 Jul 2026
CVE-2026-54275: aiohttp TLS Server Hostname Override Bypass in Connection Reuse 2.7 low 3.14.1 15 Jun 2026
CVE-2026-50269: aiohttp CRLF Injection Vulnerability in Multipart Headers 2.7 low 3.14.0 15 Jun 2026
CVE-2026-34520: AIOHTTP Header Injection Vulnerability Due to Null Bytes and Control Characters 2.7 low 3.13.4 01 Apr 2026
CVE-2026-34519: AIOHTTP HTTP Response Splitting Vulnerability via Reason Phrase Injection 2.7 low 3.13.4 01 Apr 2026
CVE-2026-34518: AIOHTTP Cookie and Proxy-Authorization Header Leak on Cross-Origin Redirects 2.7 low 3.13.4 01 Apr 2026
CVE-2026-34517: AIOHTTP Memory DoS Due to Late Size Enforcement in Multipart Fields 2.7 low 3.13.4 01 Apr 2026
CVE-2026-34514: AIOHTTP Multipart Content-Type Header CRLF Injection Vulnerability 2.7 low 3.13.4 01 Apr 2026
CVE-2026-34513: AIOHTTP Denial of Service (DoS) via Unbounded DNS Cache 2.7 low 3.13.4 01 Apr 2026
AIOHTTP Cookie Parser Warning Storm Vulnerability 2.7 low 3.13.3 05 Jan 2026
CVE-2025-69226: AIOHTTP Path Traversal Vulnerability Leading to Internal File Path Disclosure 2.7 low 3.13.3 05 Jan 2026
CVE-2025-69225: AIOHTTP Range Header Vulnerability with Unicode Match Groups 2.7 low 3.13.3 05 Jan 2026
CVE-2025-69224: AIOHTTP Header Parsing Vulnerability Leading to Request Smuggling 2.7 low 3.13.3 05 Jan 2026
CVE-2026-111749: AIOHTTP Cookie Vulnerability Allows Subdomains to Remove Host-Only Flag 2.3 low 3.14.4 20 Oct 2026
CVE-2025-53643: AIOHTTP HTTP Request/Response Smuggling Vulnerability 1.7 low 3.12.14 07 Jul 2026
CVE-2026-54280: aiohttp Payload Response Resource Leak Due to Mid-Body Disconnect 1.7 low 3.14.1 15 Jun 2026
CVE-2025-53643: AIOHTTP HTTP Request/Response Smuggling Vulnerability 1.7 low 3.12.14 14 Jul 2025
CVE-2025-53643: AIOHTTP HTTP Request/Response Smuggling Vulnerability 1.7 low 3.12.14 14 Jul 2025
CVE-2026-54279: aiohttp Host-Only Cookies Become Domain Cookies After CookieJar Persistence 1.3 low 3.14.1 15 Jun 2026
CVE-2026-111063: AIOHTTP - Secure Attribute Not Enforced for Shared Cookie N/A low 3.14.4 19 Oct 2026
CVE-2024-52304: aiohttp Request Smuggling Vulnerability Due to Incorrect Chunk Extension Parsing N/A unrated 3.10.11 07 Jul 2026
CVE-2026-34520: AIOHTTP Vulnerability Allowing Null Bytes and Control Characters in Response Headers N/A unrated 3.13.4 01 Apr 2026
CVE-2026-34516: AIOHTTP Excessive Multipart Headers Memory Consumption Vulnerability N/A unrated 3.13.4 01 Apr 2026
CVE-2026-22815: AIOHTTP Uncapped Memory Usage Due to Insufficient Header Handling N/A unrated 3.13.4 01 Apr 2026
CVE-2024-52304: aiohttp Request Smuggling Vulnerability Due to Incorrect Chunk Extension Parsing N/A medium 3.10.11 18 Nov 2024
CVE-2021-21330: Open Redirect Vulnerability in aiohttp N/A unrated 2545222a3853e31ace15d87ae0e2effb7da0c96b 26 Feb 2021

Looking for another version, or everything Vulert holds for aiohttp?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About aiohttp 3.10.0b1

Is aiohttp 3.10.0b1 vulnerable?

Yes. 83 vulnerabilities in the Vulert database cover aiohttp 3.10.0b1: 0 critical, 19 high, 36 medium and 23 low, plus 5 not yet rated. The upgrade Vulert recommends is 3.14.5, and each entry above names the fixed version to move to.

Which version of aiohttp should I use instead of 3.10.0b1?

3.14.5 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 3.10.0b1 the latest release of aiohttp?

No. 3.10.0b1 was published 22 Jul 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor aiohttp for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the aiohttp version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.