VulertSecurity VulertSecurity

Vulnerability Database · PyPI · aiohttp · Version

aiohttp 3.7.4.post0

3.7.4.post0 is affected by 99 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 3.14.5.

Critical 0 High 24 Medium 45 Low 24 Unrated 6

All aiohttp versions & vulnerabilities → Search the database for this package →
Released 06 Mar 2021 Licence Apache-2.0 AND MIT Also known from other sources 0 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

aiohttp 3.7.4.post0 vulnerabilities

99 vulnerabilities cover aiohttp 3.7.4.post0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Excessive Resource Consumption in aiohttp: A Critical Vulnerability 8.7 high 3.14.4 19 Oct 2026
CVE-2026-111066: AIOHTTP File Descriptor Exhaustion in Multipart Requests 8.2 high 3.14.4 20 Oct 2026
CVE-2026-111064: aiohttp Server Lacks Initial Request/Header Timeout 8.2 high 3.14.4 19 Oct 2026
CVE-2025-69223: AIOHTTP Zip Bomb Vulnerability Leading to DoS Attack 7.5 high 3.13.3 07 Jul 2026
CVE-2024-30251: aiohttp Denial of Service Vulnerability in POST Request Parsing 7.5 high 3.9.4 07 Jul 2026
CVE-2026-54275: AIOHTTP Server Hostname TLS SNI Check Bypass Vulnerability 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54277: AIOHTTP Memory Exhaustion Vulnerability Due to Oversized HTTP Lines 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54278: AIOHTTP Compression Handling Vulnerability Leading to Potential DoS 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54279: AIOHTTP CookieJar Host-Only Status Loss Vulnerability 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54280: AIOHTTP Resource Starvation Vulnerability 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54273: AIOHTTP Memory Exhaustion Vulnerability Due to Unbounded Pipelined Requests 7.5 high 3.14.1 22 Jun 2026
CVE-2026-54274: AIOHTTP WebSocket Frame Size Limit Bypass Vulnerability 7.5 high 3.14.1 22 Jun 2026
CVE-2026-50269: AIOHTTP Multipart Header Injection Vulnerability 7.5 high 3.14.0 22 Jun 2026
CVE-2026-47265: AIOHTTP Cookie Handling Vulnerability Leading to Potential Data Leakage 7.5 high 3.14.0 02 Jun 2026
CVE-2026-34513: AIOHTTP Unbounded DNS Cache Leading to Potential DoS 7.5 high 3.13.4 01 Apr 2026
CVE-2026-34515: AIOHTTP Static Resource Handler Information Exposure Vulnerability 7.5 high 3.13.4 01 Apr 2026
CVE-2025-69223: AIOHTTP Zip Bomb Vulnerability Leading to DoS Attacks 7.5 high 3.13.3 05 Jan 2026
CVE-2024-30251: aiohttp Denial of Service Vulnerability 7.5 high 3.9.4 03 May 2024
CVE-2024-23334: aiohttp Directory Traversal Vulnerability 7.5 high 1c335944d6a8b1298baf179b7c0b3069f10c514b 29 Jan 2024
CVE-2023-47627: aiohttp - HTTP Header Parsing Vulnerability 7.5 high d5c12ba890557a575c313bb3017910d7616fce3d 14 Nov 2023
CVE-2026-34993: AIOHTTP Arbitrary Code Execution via CookieJar.load() 7.3 high 3.14.0 02 Jun 2026
CVE-2023-49081: aiohttp CRLF Injection Vulnerability 7.2 medium 3.9.0 27 Nov 2023
CVE-2026-69244: AIOHTTP Out-of-Bounds Heap Read Vulnerability in C HTTP Response Parser 7.1 high 3.14.3 04 Aug 2026
CVE-2026-69244: AIOHTTP Out-of-Bounds Heap Read Vulnerability in C HTTP Response Parser 7.1 high 3.14.3 03 Aug 2026
CVE-2026-111065: AIOHTTP Connector Pool Exhaustion via Max-Age Overflow 6.9 medium 3.14.4 20 Oct 2026
CVE-2026-59881: AIOHTTP WebSocket Client Accepts Compressed Frames Without Negotiated Permessage-Deflate 6.9 medium 3.14.2 04 Aug 2026
CVE-2026-59881: AIOHTTP WebSocket Client Accepts Unnegotiated Compressed Frames 6.9 medium 3.14.2 03 Aug 2026
CVE-2026-22815: aiohttp Unrestricted Trailer Headers Leading to Memory Exhaustion 6.9 medium 3.13.4 01 Apr 2026
CVE-2025-69228: AIOHTTP Denial of Service Vulnerability through Large Payloads 6.6 medium 3.13.3 07 Jul 2026
CVE-2025-69229: AIOHTTP DoS Vulnerability through Chunked Messages 6.6 medium 3.13.3 07 Jul 2026
CVE-2025-69227: AIOHTTP DoS Vulnerability Due to Assert Bypass 6.6 medium 3.13.3 07 Jul 2026
CVE-2026-54274: aiohttp Incomplete WebSocket Frame Payloads Bypass Memory Limits 6.6 medium 3.14.1 15 Jun 2026
CVE-2026-54273: aiohttp HTTP/1 Pipelined Requests Queue Without Limit 6.6 medium 3.14.1 15 Jun 2026
CVE-2026-54278: aiohttp Unread Compressed Request Bodies Bypass client_max_size During Cleanup 6.6 medium 3.14.1 15 Jun 2026
CVE-2026-54277: aiohttp Package C HTTP Parser Bypass Vulnerability 6.6 medium 3.14.1 15 Jun 2026
CVE-2026-47265: AIOHTTP Cross-Origin Redirect Vulnerability with Per-Request Cookies 6.6 medium 3.14.0 03 Jun 2026
CVE-2026-34516: AIOHTTP Multipart Header Size Bypass Vulnerability 6.6 medium 3.13.4 01 Apr 2026
CVE-2026-34515: AIOHTTP Static Resource Handler Vulnerability on Windows 6.6 medium 3.13.4 01 Apr 2026
Denial of Service Vulnerability in AIOHTTP: Excessive CPU Blocking through Chunked Messages 6.6 medium 3.13.3 05 Jan 2026
Denial of Service Vulnerability in AIOHTTP: Memory Exhaustion via Large Payloads 6.6 medium 3.13.3 05 Jan 2026
CVE-2025-69227: AIOHTTP Denial of Service Vulnerability Due to Assert Bypass 6.6 medium 3.13.3 05 Jan 2026
CVE-2024-23829: aiohttp HTTP Parser Overly Lenient Separator Vulnerability 6.5 medium 3.9.2 29 Jan 2024
CVE-2024-23829: aiohttp - Incomplete Fix for HTTP Parser Vulnerability 6.5 medium 33ccdfb0a12690af5bb49bda2319ec0907fa7827 29 Jan 2024
CVE-2023-47641: aiohttp Inconsistent Interpretation of HTTP Protocol 6.5 medium f016f0680e4ace6742b03a70cb0382ce86abe371 14 Nov 2023
CVE-2026-34993: AIOHTTP Vulnerable to Deserialization of Untrusted Data 6.4 medium 3.14.0 03 Jun 2026
CVE-2026-111748: AIOHTTP Absolute-Form Request Target Spoofing Vulnerability 6.3 medium 3.14.4 20 Oct 2026
CVE-2026-111750: AIOHTTP Pure-Python Parser Request Smuggling Vulnerability 6.3 medium 3.14.4 20 Oct 2026
CVE-2026-69243: AIOHTTP HTTP Request Smuggling via WebSocket Upgrade 6.3 medium 3.14.2 04 Aug 2026
CVE-2026-69243: AIOHTTP HTTP Request Smuggling via WebSocket Upgrade 6.3 medium 3.14.2 03 Aug 2026
CVE-2026-54276: aiohttp DigestAuthMiddleware Exposes Credentials to Cross-Origin Redirects 6.3 medium 3.14.1 15 Jun 2026
CVE-2026-34525: AIOHTTP Duplicate Host Header Vulnerability 6.3 medium 3.13.4 01 Apr 2026
CVE-2024-27306: aiohttp Cross-site Scripting Vulnerability in Static File Handling 6.1 medium 3.9.4 07 Jul 2026
CVE-2026-54276: AIOHTTP DigestAuthMiddleware Cross-Origin Redirect Vulnerability 6.1 medium 3.14.1 22 Jun 2026
CVE-2024-27306: aiohttp Cross-site Scripting vulnerability on index pages for static file handling 6.1 medium 3.9.4 18 Apr 2024
CVE-2024-23334: aiohttp Directory Traversal Vulnerability 5.9 high 3.9.2 29 Jan 2024
CVE-2022-33124: Denial of Service in aiohttp 5.5 medium No fix published 24 Jun 2022
CVE-2022-33124: AIOHTTP 3.8.1 Denial of Service Vulnerability 5.5 medium No fix published 23 Jun 2022
CVE-2026-34525: aiohttp Multiple Host Header Vulnerability 5.3 medium 3.13.4 01 Apr 2026
CVE-2026-34519: AIOHTTP Response Header Injection Vulnerability 5.3 medium 3.13.4 01 Apr 2026
CVE-2026-34518: AIOHTTP Authorization Header Vulnerability in Redirects 5.3 medium 3.13.4 01 Apr 2026
CVE-2026-34517: AIOHTTP Memory Handling Vulnerability in Multipart Form Fields 5.3 medium 3.13.4 01 Apr 2026
CVE-2026-34514: AIOHTTP Content-Type Parameter Vulnerability Leading to Header Injection 5.3 medium 3.13.4 01 Apr 2026
CVE-2023-49081: aiohttp - Improper Validation Allows HTTP Request Modification 5.3 medium 1e86b777e61cf4eefc7d92fa57fa19dcc676013b 30 Nov 2023
CVE-2023-49082: aiohttp - Improper Validation Allows HTTP Request Modification 5.3 medium e4ae01c2077d2cfa116aa82e4ff6866857f7c466 29 Nov 2023
CVE-2023-49082: aiohttp CRLF Injection Vulnerability 5.3 medium 3.9.0 27 Nov 2023
CVE-2023-47627: AIOHTTP HTTP Parser Vulnerability 5.3 medium 3.8.6 14 Nov 2023
CVE-2023-37276: aiohttp.web.Application HTTP Request Smuggling Vulnerability 5.3 medium 3.8.5 20 Jul 2023
CVE-2023-47641: Inconsistent Interpretation of Content-Length vs. Transfer-Encoding in aiohttp 3.4 low 3.8.0 14 Nov 2023
CVE-2025-69230: AIOHTTP Cookie Parser Warning Storm Vulnerability 2.7 low 3.13.3 07 Jul 2026
CVE-2025-69225: AIOHTTP - Potential Request Smuggling Vulnerability Due to Unicode Match Groups 2.7 low 3.13.3 07 Jul 2026
CVE-2025-69226: AIOHTTP Brute-Force Leak of Internal Static File Path Components 2.7 low 3.13.3 07 Jul 2026
CVE-2025-69224: AIOHTTP Request Smuggling Vulnerability Due to Unicode Processing 2.7 low 3.13.3 07 Jul 2026
CVE-2026-54275: aiohttp TLS Server Hostname Override Bypass in Connection Reuse 2.7 low 3.14.1 15 Jun 2026
CVE-2026-50269: aiohttp CRLF Injection Vulnerability in Multipart Headers 2.7 low 3.14.0 15 Jun 2026
CVE-2026-34520: AIOHTTP Header Injection Vulnerability Due to Null Bytes and Control Characters 2.7 low 3.13.4 01 Apr 2026
CVE-2026-34519: AIOHTTP HTTP Response Splitting Vulnerability via Reason Phrase Injection 2.7 low 3.13.4 01 Apr 2026
CVE-2026-34518: AIOHTTP Cookie and Proxy-Authorization Header Leak on Cross-Origin Redirects 2.7 low 3.13.4 01 Apr 2026
CVE-2026-34517: AIOHTTP Memory DoS Due to Late Size Enforcement in Multipart Fields 2.7 low 3.13.4 01 Apr 2026
CVE-2026-34514: AIOHTTP Multipart Content-Type Header CRLF Injection Vulnerability 2.7 low 3.13.4 01 Apr 2026
CVE-2026-34513: AIOHTTP Denial of Service (DoS) via Unbounded DNS Cache 2.7 low 3.13.4 01 Apr 2026
AIOHTTP Cookie Parser Warning Storm Vulnerability 2.7 low 3.13.3 05 Jan 2026
CVE-2025-69226: AIOHTTP Path Traversal Vulnerability Leading to Internal File Path Disclosure 2.7 low 3.13.3 05 Jan 2026
CVE-2025-69225: AIOHTTP Range Header Vulnerability with Unicode Match Groups 2.7 low 3.13.3 05 Jan 2026
CVE-2025-69224: AIOHTTP Header Parsing Vulnerability Leading to Request Smuggling 2.7 low 3.13.3 05 Jan 2026
CVE-2026-111749: AIOHTTP Cookie Vulnerability Allows Subdomains to Remove Host-Only Flag 2.3 low 3.14.4 20 Oct 2026
CVE-2025-53643: AIOHTTP HTTP Request/Response Smuggling Vulnerability 1.7 low 3.12.14 07 Jul 2026
CVE-2026-54280: aiohttp Payload Response Resource Leak Due to Mid-Body Disconnect 1.7 low 3.14.1 15 Jun 2026
CVE-2025-53643: AIOHTTP HTTP Request/Response Smuggling Vulnerability 1.7 low 3.12.14 14 Jul 2025
CVE-2025-53643: AIOHTTP HTTP Request/Response Smuggling Vulnerability 1.7 low 3.12.14 14 Jul 2025
CVE-2026-54279: aiohttp Host-Only Cookies Become Domain Cookies After CookieJar Persistence 1.3 low 3.14.1 15 Jun 2026
CVE-2026-111063: AIOHTTP - Secure Attribute Not Enforced for Shared Cookie N/A low 3.14.4 19 Oct 2026
CVE-2024-52304: aiohttp Request Smuggling Vulnerability Due to Incorrect Chunk Extension Parsing N/A unrated 3.10.11 07 Jul 2026
CVE-2026-34520: AIOHTTP Vulnerability Allowing Null Bytes and Control Characters in Response Headers N/A unrated 3.13.4 01 Apr 2026
CVE-2026-34516: AIOHTTP Excessive Multipart Headers Memory Consumption Vulnerability N/A unrated 3.13.4 01 Apr 2026
CVE-2026-22815: AIOHTTP Uncapped Memory Usage Due to Insufficient Header Handling N/A unrated 3.13.4 01 Apr 2026
CVE-2024-52304: aiohttp Request Smuggling Vulnerability Due to Incorrect Chunk Extension Parsing N/A medium 3.10.11 18 Nov 2024
Vulnerability in aiohttp package: Request Smuggling N/A medium 3.8.6 27 Nov 2023
CVE-2023-37276: aiohttp.web.Application vulnerable to HTTP request smuggling N/A unrated 3.8.5 20 Jul 2023
CVE-2021-21330: Open Redirect Vulnerability in aiohttp N/A unrated 2545222a3853e31ace15d87ae0e2effb7da0c96b 26 Feb 2021

Looking for another version, or everything Vulert holds for aiohttp?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About aiohttp 3.7.4.post0

Is aiohttp 3.7.4.post0 vulnerable?

Yes. 99 vulnerabilities in the Vulert database cover aiohttp 3.7.4.post0: 0 critical, 24 high, 45 medium and 24 low, plus 6 not yet rated. The upgrade Vulert recommends is 3.14.5, and each entry above names the fixed version to move to.

Which version of aiohttp should I use instead of 3.7.4.post0?

3.14.5 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 3.7.4.post0 the latest release of aiohttp?

No. 3.7.4.post0 was published 06 Mar 2021, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor aiohttp for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the aiohttp version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.