aiohttp vulnerabilities — 104 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
6.3 medium CVE-2026-111748: AIOHTTP Absolute-Form Request Target Spoofing Vulnerability aiohttp PyPI 20 Oct 2026 3.14.4
2.3 low CVE-2026-111749: AIOHTTP Cookie Vulnerability Allows Subdomains to Remove Host-Only Flag aiohttp PyPI 20 Oct 2026 3.14.4
6.9 medium CVE-2026-111065: AIOHTTP Connector Pool Exhaustion via Max-Age Overflow aiohttp PyPI 20 Oct 2026 3.14.4
6.3 medium CVE-2026-111750: AIOHTTP Pure-Python Parser Request Smuggling Vulnerability aiohttp PyPI 20 Oct 2026 3.14.4
8.2 high CVE-2026-111066: AIOHTTP File Descriptor Exhaustion in Multipart Requests aiohttp PyPI 20 Oct 2026 3.14.4
8.2 high CVE-2026-111064: aiohttp Server Lacks Initial Request/Header Timeout aiohttp PyPI 19 Oct 2026 3.14.4
Low CVE-2026-111063: AIOHTTP - Secure Attribute Not Enforced for Shared Cookie aiohttp PyPI 19 Oct 2026 3.14.4
8.7 high Excessive Resource Consumption in aiohttp: A Critical Vulnerability aiohttp PyPI 19 Oct 2026 3.14.4
6.3 medium CVE-2026-69243: AIOHTTP HTTP Request Smuggling via WebSocket Upgrade aiohttp PyPI 04 Aug 2026 3.14.2
7.1 high CVE-2026-69244: AIOHTTP Out-of-Bounds Heap Read Vulnerability in C HTTP Response Parser aiohttp PyPI 04 Aug 2026 3.14.3
6.9 medium CVE-2026-59881: AIOHTTP WebSocket Client Accepts Compressed Frames Without Negotiated Permessage-Deflate aiohttp PyPI 04 Aug 2026 3.14.2
7.1 high CVE-2026-69244: AIOHTTP Out-of-Bounds Heap Read Vulnerability in C HTTP Response Parser aiohttp PyPI 03 Aug 2026 3.14.3
6.3 medium CVE-2026-69243: AIOHTTP HTTP Request Smuggling via WebSocket Upgrade aiohttp PyPI 03 Aug 2026 3.14.2
6.9 medium CVE-2026-59881: AIOHTTP WebSocket Client Accepts Unnegotiated Compressed Frames aiohttp PyPI 03 Aug 2026 3.14.2
6.6 medium CVE-2025-69228: AIOHTTP Denial of Service Vulnerability through Large Payloads aiohttp PyPI 07 Jul 2026 3.13.3
2.7 low CVE-2025-69230: AIOHTTP Cookie Parser Warning Storm Vulnerability aiohttp PyPI 07 Jul 2026 3.13.3
6.6 medium CVE-2025-69229: AIOHTTP DoS Vulnerability through Chunked Messages aiohttp PyPI 07 Jul 2026 3.13.3
2.7 low CVE-2025-69226: AIOHTTP Brute-Force Leak of Internal Static File Path Components aiohttp PyPI 07 Jul 2026 3.13.3
2.7 low CVE-2025-69224: AIOHTTP Request Smuggling Vulnerability Due to Unicode Processing aiohttp PyPI 07 Jul 2026 3.13.3
6.6 medium CVE-2025-69227: AIOHTTP DoS Vulnerability Due to Assert Bypass aiohttp PyPI 07 Jul 2026 3.13.3
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.