VulertSecurity VulertSecurity

Vulnerability Database · PyPI · aiohttp · Version

aiohttp 3.13.5

3.13.5 is affected by 40 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 3.14.5.

Critical 0 High 15 Medium 18 Low 6 Unrated 1

All aiohttp versions & vulnerabilities → Source repository Search the database for this package →
Released 31 Mar 2026 Licence Apache-2.0 AND MIT Also known from other sources 36 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

aiohttp 3.13.5 vulnerabilities

40 vulnerabilities cover aiohttp 3.13.5. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Excessive Resource Consumption in aiohttp: A Critical Vulnerability 8.7 high 3.14.4 19 Oct 2026
CVE-2026-111066: AIOHTTP File Descriptor Exhaustion in Multipart Requests 8.2 high 3.14.4 20 Oct 2026
CVE-2026-111064: aiohttp Server Lacks Initial Request/Header Timeout 8.2 high 3.14.4 19 Oct 2026
CVE-2026-54280: AIOHTTP Resource Starvation Vulnerability 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54279: AIOHTTP CookieJar Host-Only Status Loss Vulnerability 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54278: AIOHTTP Compression Handling Vulnerability Leading to Potential DoS 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54277: AIOHTTP Memory Exhaustion Vulnerability Due to Oversized HTTP Lines 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54275: AIOHTTP Server Hostname TLS SNI Check Bypass Vulnerability 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54274: AIOHTTP WebSocket Frame Size Limit Bypass Vulnerability 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54273: AIOHTTP Memory Exhaustion Vulnerability Due to Unbounded Pipelined Requests 7.5 high 3.14.1 22 Jun 2026
CVE-2026-50269: AIOHTTP Multipart Header Injection Vulnerability 7.5 high 3.14.0 22 Jun 2026
CVE-2026-47265: AIOHTTP Cookie Handling Vulnerability Leading to Potential Data Leakage 7.5 high 3.14.0 02 Jun 2026
CVE-2026-34993: AIOHTTP Arbitrary Code Execution via CookieJar.load() 7.3 high 3.14.0 02 Jun 2026
CVE-2026-69244: AIOHTTP Out-of-Bounds Heap Read Vulnerability in C HTTP Response Parser 7.1 high 3.14.3 04 Aug 2026
CVE-2026-69244: AIOHTTP Out-of-Bounds Heap Read Vulnerability in C HTTP Response Parser 7.1 high 3.14.3 03 Aug 2026
CVE-2026-111065: AIOHTTP Connector Pool Exhaustion via Max-Age Overflow 6.9 medium 3.14.4 20 Oct 2026
CVE-2026-59881: AIOHTTP WebSocket Client Accepts Compressed Frames Without Negotiated Permessage-Deflate 6.9 medium 3.14.2 04 Aug 2026
CVE-2026-59881: AIOHTTP WebSocket Client Accepts Unnegotiated Compressed Frames 6.9 medium 3.14.2 03 Aug 2026
CVE-2026-54274: aiohttp Incomplete WebSocket Frame Payloads Bypass Memory Limits 6.6 medium 3.14.1 15 Jun 2026
CVE-2026-54273: aiohttp HTTP/1 Pipelined Requests Queue Without Limit 6.6 medium 3.14.1 15 Jun 2026
CVE-2026-54278: aiohttp Unread Compressed Request Bodies Bypass client_max_size During Cleanup 6.6 medium 3.14.1 15 Jun 2026
CVE-2026-54277: aiohttp Package C HTTP Parser Bypass Vulnerability 6.6 medium 3.14.1 15 Jun 2026
CVE-2026-47265: AIOHTTP Cross-Origin Redirect Vulnerability with Per-Request Cookies 6.6 medium 3.14.0 03 Jun 2026
CVE-2024-23829: aiohttp - Incomplete Fix for HTTP Parser Vulnerability 6.5 medium 33ccdfb0a12690af5bb49bda2319ec0907fa7827 29 Jan 2024
CVE-2026-34993: AIOHTTP Vulnerable to Deserialization of Untrusted Data 6.4 medium 3.14.0 03 Jun 2026
CVE-2026-111748: AIOHTTP Absolute-Form Request Target Spoofing Vulnerability 6.3 medium 3.14.4 20 Oct 2026
CVE-2026-111750: AIOHTTP Pure-Python Parser Request Smuggling Vulnerability 6.3 medium 3.14.4 20 Oct 2026
CVE-2026-69243: AIOHTTP HTTP Request Smuggling via WebSocket Upgrade 6.3 medium 3.14.2 04 Aug 2026
CVE-2026-69243: AIOHTTP HTTP Request Smuggling via WebSocket Upgrade 6.3 medium 3.14.2 03 Aug 2026
CVE-2026-54276: aiohttp DigestAuthMiddleware Exposes Credentials to Cross-Origin Redirects 6.3 medium 3.14.1 15 Jun 2026
CVE-2026-54276: AIOHTTP DigestAuthMiddleware Cross-Origin Redirect Vulnerability 6.1 medium 3.14.1 22 Jun 2026
CVE-2022-33124: Denial of Service in aiohttp 5.5 medium No fix published 24 Jun 2022
CVE-2022-33124: AIOHTTP 3.8.1 Denial of Service Vulnerability 5.5 medium No fix published 23 Jun 2022
CVE-2026-54275: aiohttp TLS Server Hostname Override Bypass in Connection Reuse 2.7 low 3.14.1 15 Jun 2026
CVE-2026-50269: aiohttp CRLF Injection Vulnerability in Multipart Headers 2.7 low 3.14.0 15 Jun 2026
CVE-2026-111749: AIOHTTP Cookie Vulnerability Allows Subdomains to Remove Host-Only Flag 2.3 low 3.14.4 20 Oct 2026
CVE-2026-54280: aiohttp Payload Response Resource Leak Due to Mid-Body Disconnect 1.7 low 3.14.1 15 Jun 2026
CVE-2026-54279: aiohttp Host-Only Cookies Become Domain Cookies After CookieJar Persistence 1.3 low 3.14.1 15 Jun 2026
CVE-2026-111063: AIOHTTP - Secure Attribute Not Enforced for Shared Cookie N/A low 3.14.4 19 Oct 2026
CVE-2021-21330: Open Redirect Vulnerability in aiohttp N/A unrated 2545222a3853e31ace15d87ae0e2effb7da0c96b 26 Feb 2021

Looking for another version, or everything Vulert holds for aiohttp?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About aiohttp 3.13.5

Is aiohttp 3.13.5 vulnerable?

Yes. 40 vulnerabilities in the Vulert database cover aiohttp 3.13.5: 0 critical, 15 high, 18 medium and 6 low, plus 1 not yet rated. The upgrade Vulert recommends is 3.14.5, and each entry above names the fixed version to move to.

Which version of aiohttp should I use instead of 3.13.5?

3.14.5 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 3.13.5 the latest release of aiohttp?

No. 3.13.5 was published 31 Mar 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor aiohttp for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the aiohttp version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.